mSecure needs to respond immediately.  I need a response or I will have to migrate everything to a new password locker for me and all my employees.

We deserve a more thorough explanation and response from mSeven. Were they truly zero-knowledge architecture? It seems not based on the alarm raised in this email.

To help properly assess and mitigate risk, please provide detailed information on the following:
  - Remedial Actions: What specific, actionable steps must be taken on user end to secure account and data?
  - Scope of Compromise: What specific data fields, files, or customer records were impacted or accessed during this breach?
  - Timeframe: What was the exact timeframe of the breach, including when it occurred and when it was detected?

In case this problem is not resolved, do any of you other customers here  have ideas for other password managers that have good functionality for offline users? The thing that attracted me to mSecure was the fact that it works well offlline. Also, it can sync locally by Wifi with other computers, which I use for sharing with my family members. This serves to make it possible for them to have access to the passwords and also as a backup. A lot of the top rated password managers are meant to be used locally. And I'm not sure if the ones that do have offline functionality have wifi sharing. Ideas?

 Oops. I meant that at least some of the top-rated password managers do NOT support only using the app offline.

I sync using Dropbox, am i at risk too?

5 service tickets opened to address mSecure’s not so secure app and their security breach.  mSecure keeps closing my tickets without a response.  My guess is the company is in chaos and cannot answer us AND if that’s true, then they will walk away from this HUGE problem.  I hope I’m wrong and they are busy trying to fix this.  At this point I’m not even sure it’s safe to sign into mSecure to change any passwords without letting in a worst issue.  There must be way fix this other than changing hundreds of passwords.

I don't think all customers even received that email. My wife and I both have V.6 and never subscribed. She never uses her account, though she's in their database. I, on the other hand, use my account every day. Yet, my wife received the security breach email (it was in her spam folder), but I did not receive it. How is it that some customers are receiving this alert while others are not?

Is this a company that only works 9 till 5 Canadian time?!!!  If so, Toronto should be open by now.  No news beyond that worrying first email is absolutely unsatisfactory.

In response to security breach email of 11/03/26l:  The LEAST mSecure should do is offer is 2 factor authentication to "Essentials" accounts.

Yes we the users definitely need more information.  Just looked at the number of passwords I have and it is over 200.  Would have to sort out the critical ones,  change those passwords, store them somewhere and then go back and do the less important ones.  And is it safe to keep the changed passwords on msecure?  Probably not.  This entails a lot of work and we should have more info before starting it.  Very poor method of communication from msecure.  Not enought infor from them and not enough specificity on what the user should/has to do.

We need an update now. Besides changing the entry password and adding 2factor. Do we really need to change all of our passwords?  Wake up support

I am not an employee of MSeven.  However, having worked in IT and experienced a data breach, I would think MSeven is actively trying to understand the method used to break in, block access to the bad actor and ascertain what info was stolen.  That is their primary focus.  It may take them a few days to collect more accurate information.  

The first people called after these incidents are typically lawyers specializing in data breaches. Those lawyers will likely suggest the company get the word out to their customers with the maximal possible consequences (change everything) because if they don't or if people misunderstand the notice and don't take action and lose money etc... MSeven could be liable.   Plus they need to keep what they know about the hack internal only, because clearly the hacker could be reading these forums.  Explaining what they know could alert the hacker if they are close to finding them or how they could possible modify the attack to continue stealing data.  

The ecosystem around Msecure is complicated.  There are many ways to use MSecure, if you don't share any info with MSeven, (offline user only, no web browser extension, backup and sync to third party Dropbox, iCloud, etc...) you might not be impacted.  However others who have an account setup online might. It's hard to know and non-technical customers would have no way of knowing.  If the Msecure code itself was modified by a hacker and deployed then everyone and every secure record is at risk.

You may never get a straight answer from MSeven, or they may provide more information.  Without more information they will lose all the trust customers have in their product.  This could mean the demise of the company, so they may release more information.  It's hard to tell.  I am sure the company senior executives are having these discussions already with their lawyers and financial backers.

I would suggest that everyone change their master password and prioritize changing passwords for financial institutions, primary email accounts and high value accounts.  

mSecure, obviously not so secure?????
Whats happening? more info from mSecure please!!!!!!!!!!!

Can users of the free app (no paid subscription) export all data to a .csv file?