This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

I don't understand how changing msecure password would solve the problem. 
If the problem is in the app until we get a new version changing the main password I think is useless.
If the problem is on their cloud because of syncing changing the main password would just be the 1st step and all the other entries we have should be changed too. 
But if everything is synced encrypted why would this be a problem also if someone accessed their servers ?

The email headers of the email I received seem legitimate and in my case the headers reported freshmail.io which is the internal email system of freshdesk.com a tool used by mSeven for customer care (according to AI).

Could it be that mSeven got hacked and this 3rd party ticketing system too got hacked and now if we change our main password they will have the key to decrypt our data ?

Am I wrong somewhere ?

@Francesco It could be all that. It could be a compromised app that silently shares data with thieves. We dont know. Obviously msecure also doesn’t know. But given the fact they went completely dark, embrace for the very worst case scenario that one can think of. Msecure is a lame duck now, not worth trusting at all. It could have fared much better but 10 or more hours screaming silence from the developer(s?) says it all. They are completely not in control of the situation at all anymore. No communication is FATAL for any company in a situation like this. Msecure is EOL, unfortinately.

Couldn't possibly agree more. This silence makes this EOL as far as I am concerned. Actively moving off insecure, I mean msecure for good. 

Fully agree. Can be nothing, can be a disaster, but detailed answers are overdue after so many hours, while this silence says it all. 

Game over

Fully agree with all of the aforementioned sentiments and the frustrations.

I'll add one more tidbit of aggravation to this entire process:

* IF my mSecure login has been compromised then I must change the primary login password and setup 2FA

     * Changing password - check

     * Setting up 2FA - . . .WHAT!?! This is a PREMIUM ONLY feature!!!

Of all the days to drop the pay-wall to certain barriers, TODAY IS THE DAY!

I looked up mSeven Software LLC and Google says the private company is between 11-50 employees. In this moment I can only picture three dudes huddling in the corner of a garage, hugging their knees and rocking back and forth muttering "what to do...". 

This is bullshit though as they built themselves on an app that provided a home for secrets. If they have practiced for potential breaches then they are totally failing their rehearsal. I know sometimes the lawyers and team for cyber security insurance companies can step in and try to manage things like this, keeping information outflows slow.  However, this silence makes everyone feel that they have no plans, no insurance and are complete idiots. 

I am a customer like everyone else and we trusted them. Sad that a company can tinker around with security for the public, making money for years and then just abandon it all when things get tough. Hopefully it all comes with the necessary repercussions as their failure places the burden squarely on us as the customer.

OK, as others many questions.

I have never synced to the cloud, only between my devices. Am I still in danger?

WHICH versions of mSecure are affected? I use an older version! 

I did change mSecure password on all devices and all including Mac work and sync between them.

And agree, a despicably worded email with little to no  information. Will post this same in all threads I care to follow until we know more. I am not about to start changing 400 passwords.

After initial measures and based on the complete absence of mSecure answers, I've decided to cancel my mSecure subscription.

The interesting part is that it is not possible to cancel your subscription...

"We are in the process of updating to a newer subscription platform, so some of the features on our new website will not work with older subscriptions. As soon as the migration is complete, all features will be available to all customers. In the meantime, we’re available to process any changes you would like to make including upgrading, downgrading or canceling your subscription. Click “Get Help” to email our support team."

Claude says the email is legit and the breach is also real. 

"The Register, CyberInsider, Heise and others all report that mSeven sent the email to current and former customers on November 3, and a recipient posted a screenshot of the same text on Infosec Exchange. Recipients also posted it in mSeven’s own support forum, which is a strong sign it came from the company itself. The wording matches across all of these."

Andy, this is correct. However, under the given circumstances, mSeven would react if the Email information was fake. This is not the case. To make it clear: This type of non-communication may be taken as an indicator that the security breack ist at the maximum of what you can imagine.

OK, I am now a little more entered. My latest thoughts for me is:

• I use an older version.
• I have never synced to the cloud
• I sync over my private wifi network by IP address and port
• I should not be affected in any way.