A few things.   When will you let us know if our social security numbers including all of my family SS numbers have been exposed ?

When will let us know what else has been exposed?

Is everything I have put in mSecure over the last 15-20 years now exposed ?

I am having to change hundreds of passwords over a huge number of hours and appreciate more info asap.

Will you be refunding our fees paid as now I have to migrate to another password manager over time?

Can you tell me the best way to migrate my data from your platform to 1Password app?

Is there a good reason that i should NOT being migrating to a new platform and spending dozens of hours changing passwords ?  Not that it will fix all of my exposed personal information.. 

Some clarity please and would appreciate a phone call if possible to my mobile, my whole family have been long time users.

David,

I have the same questions as you!!!  Very vague email from them really explaining nothing!  What legal resposibilities does this company have now that our data has been hacked.  What has been hacked????  I am like you and have a lot of information on the mSecure app, thinking it would be totally safe, and now I am thinking of moving my stuff elswhere as well.  I hope they respond us, the costumer, very soon!

Given their silence, we simply have to assume the worst scenario and mitigate accordingly. Not sure if we'll ever get a word out of them; they may simply fold.

 As a password management provider, mSeven has a heightened responsibility to provide clear, technically meaningful information when the security of customer credentials may be at risk.

Your notification advises customers to consider changing passwords, resetting two-factor authentication, and removing passkeys, yet provides no explanation of the nature, extent, or consequences of the incident.

Please provide direct answers to the following:

1. What systems were compromised, and what unauthorized access has been confirmed?
2. Were customer password vaults, encrypted databases, backups, or any plaintext information accessed or exfiltrated?
3. Were encryption keys, authentication tokens, master password verifiers, or other cryptographic materials compromised?
4. Has mSecure's zero-knowledge security architecture been independently verified as intact?
5. Could attackers have obtained information sufficient to decrypt customer vaults, either immediately or through offline attacks?
6. Has the integrity of the mSecure applications and their software distribution mechanisms been verified?
7. Is it currently safe for customers to continue using mSecure and storing newly changed credentials?
8. Does the incident affect customers using iCloud, Dropbox, Wi-Fi synchronization, or local-only storage, or is it limited to mSecure Cloud?
9. Why specifically are customers being advised to replace two-factor authentication credentials and passkeys? What evidence supports this recommendation?
10. Does changing the master password invalidate potentially compromised encryption keys and re-encrypt existing vault data?
11. What is the confirmed timeline of the intrusion, discovery, containment, and remediation?
12. Will mSeven release an independent forensic report detailing the root cause, extent of exposure, and corrective actions?

Most importantly, customers require an explicit determination of whether they should consider **every credential stored in mSecure to be compromised**, and whether the current application can safely be used to perform the recommended remediation.

Recommending potentially hundreds of credential changes without identifying the underlying threat, the affected customers, or the security of the application being used to make those changes is inadequate.

Not heard a thing back, wondering if they think this is all going to blow over or they just close their doors?   Very disappointed.   

Mark, I am very close to filing an FTC Fraud report because mSeven has not been forthcoming/transparent about the nature of breach.  Not sure what mSeven's attorneys are telling you but when the FTC gets involved you'll be forced to release way more than attorney's are telling you you have to.

What exactly was stolen? Were individual encrypted customer vaults acquired, or was this a separate customer-account database? Please identify the categories of information contained in the stolen database, including any unencrypted customer metadata.

Can the stolen database be subjected to offline attacks against customers’ master passwords? mSecure’s security architecture reportedly requires a locally generated 46-character Account Key. Was this Account Key, or any equivalent cryptographic material capable of facilitating decryption, accessible to the unauthorized actor? Can mSeven confirm that the stolen database cannot be decrypted without each customer’s unique Account Key?

What security benefit does changing the master password provide following this incident?Does changing the master password generate new encryption keys and re-encrypt the entire vault, or does it merely change how the existing encryption key is protected? Since the attacker already possesses a copy of the encrypted database, how would changing the master password protect that previously acquired copy?

How did the unauthorized actor acquire the database, and what evidence confirms the intrusion has been contained? Please provide the known timeline of the intrusion, discovery, containment, and remediation. Has an independent cybersecurity firm verified that the attacker’s access has been terminated and that no additional systems or cryptographic materials were compromised?

Your repeated assertion that mSeven has “no evidence” of unauthorized access to the confidential information does not establish that the stolen database cannot be decrypted.

Please distinguish between what has been independently verified, what remains under investigation, and what mSeven is merely assuming based on its encryption architecture.

Given the sensitivity of the information customers have entrusted to mSecure, I would appreciate specific technical answers rather than generalized reassurances.