This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

For those of you considering moving to Enpass which allows to sync via WiFi with a master computer on your LAN: Enpass promotes that they could import the CSV export from mSecure.

Well, it's true - somehow. The import interface does not interpret the structure of the CSV well and does not delimit filed names from the attributes stored in the fields. So I had to touch every item and every field in it - except notes. They were correctly taken over even in multiline format.
The deficit on the import is known by Enpass for some years but never got fixed. I guess the number of users wanting to switch from mSecure to Enpass where too little.

Since I lost trust in mSecure as a company because of their extremely poor communication even to long term users like me (> 10 yers), I moved away from their product.

Keypass could have been anon source  alternative but synchronization between multiple devices handled by multiple people didn't provide the right woman accept factor.

@Hans-Josef

I also imported my mSecure CSV file into Enpass, but for me, it worked remarkably well. Almost every entry has the correct attribute field assigned right. Login entries, bank, and credit card entries all were done correctly.I found a few instances where it wasn’t right, but then I went back and looked at mSecure and I actually had the wrong category selected there. So totally use your error.  

I’m wondering if when you imported your CSV file into Enpass, you just directly selected import from CSV instead of clicking on the import from previous password manager and then select selecting M secure?

@Iain

Yes, it's still very unclear and ambiguous. Until mSecure issues a further communication clarifying exactly what happened and who is affected, the jury is still out. However, if their statement is correct, users who used other sync options or local Wi-Fi Sync should hopefully be unaffected.

For clarification, this was their exact wording:

"Please note, this issue only pertains to users that were syncing with the mSecure Cloud. You can check this via your syncing settings (in settings)."

@Mark Green , Mark, I have a lot of respect for your work, and I understand that the decision to say certain things likely isn’t yours, but…
You cannot claim that support resources are primarily dedicated to the data breach issue—because all of us, regardless of the specific details we ask about, are receiving the exact same standard  response regarding this serious matter; a message that could just as easily be handled by a simple auto-reply!
Furthermore, you can’t just direct inquiries about this issue to an email address, while preemptively stating that—due to "high volumes" (really? Guess why)—there will be a delay in your response. The fact is, you haven’t answered a single question for days—period. You should have already taken the initiative to provide clarity by issuing a proactive statement to everyone. Come on…! 

@Hans-Josef

I had great success testing Enpass with a selection of mSecure records, it was perfect.

I was very surprised to see mSecure as an option for importing from other password managers, the method @Andrew used, it's something I've not seen when checking out other options.

@Mark mSecure

It's all well and good replying on this forum but with no extra clarification? Really

WHY NOT address the outstanding questions being raised on this forum or send out an official communication explaining what you know?

Your current approach only serves to frustrate customers further. The responses so far have been largely ineffectual and have done little to reassure anyone or allay their concerns.  Surely it would be more efficient to provide one clear, transparent update to the entire user base rather than dealing with the same questions individually through support tickets.

The lack of clear communication is making an already concerning situation worse and is only serving to increase customer anxiety and undermine confidence in mSecure.

You must realise that the longer you delay sending a clear, transparent email explaining exactly who is affected, the more customers you are losing.

Customers deserve some transparency and that is severally lacking in the one measly mSecure communication thus far.

@Mark- mSecure

I totally agree with the previous posters that responded to your post about the inadequacies of it.. But would also like to point out that you called it “the mSecure cloud breach email that was previously sent out” but absolutely nowhere in that email did you tell us that it was only mSecure cloud users that were affected! So instead of having 50%, 25%, 10% of your users, however, many were using mSecure cloud, in a panic you had absolutely every single one of your users in an absolute panic and scrambling to change their accounts. And any user that hasn’t written into your support or read these forms, still thinks that all their information is compromised whether they used the mSecure cloud or not. Totally unacceptable!

Unbelievable. Truly. You think the trouble tickets would be immensely less busy with one comprehensive and clear email or posting here! They have lost me as well.

 Today I use mSecure on iPhone, iPad, Windows and Mac and synce each to the master on Mac manually through my home network. Works (ed) well. Seems Keepass in its various forms is my best replacement choice. Has anyone done a similar setup there importing from mSecure and easily syncing with no cloud of any kid involved?

@Corrado: interesting approach! Firstly, I didn't have the idea that AII could help and secondly, thinking about it, I wouldn't want to share such content with a cloud-based KI - even when passwords and such are xxxxxx-ed. In our usage of mSecure we didn't stick only to the templates but used the flexibility to add/remove/reorder fields.

@Andrew: during the import steps I've chosen to import from previous password manager and then picked mSecure from the list.

Maybe our heavily customized templates were causing the strange import behavior. Or it's a separation character issue given by the country/language settings and MacOS I'm working on. 

Anyway, the good thing:: I had to look at each entry and rethink, whether it is still required or could be even improved. A bad weather cleanup exercise. :-)