Hi everyone! I have just gotten a response for the ticket I submitted last night to mSecure. The representative in contact with me alleges that the issue only pertains to users that were syncing to the mSecure Cloud. I hope some of you find that helpful. Nonetheless, I will be switching after ten years as I find it unacceptable that this was not confirmed earlier. 

Also, there is “no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.

Could you copy and paste the whole response for us all to see please? Very surprised that if they had time to respond to your ticket why they don't make an official announcement on their website or on these forums considering how many people are bombarding them with queries.

Sure thing Ai. Here is the copy and paste the response I received:

“Yesterday, mSeven Software (“mSeven”) learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application. Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.

Thank you.

Thanks for the information.

I've also been an mSecure user and supporter for around 10 years - back to the early versions.

(I was always a bit sceptical of the mSecure Cloud - I remember that mSeven had to be pushed to provide alternate methods of synching records - they had originally planned that their cloud would be the only option).

Unfortunately they haven't "provided as much information as was reasonably available" - this support response gives much more information than the original email.

They should have flooded us with updates - trust has gone.

@Eltoro, I don't think that you'll get a proper response.

Just to be clear, the response they're giving is simply copy and pasted. They do not address specific questions ... it looks like all the tickets are getting exactly the same response, which is the one posted by @Caitlin.

What's strange is that they are not publishing this on their website. To elicit this response, you have to raise a ticket, but it will contain no more than what you can see now on the forums.

It would save them a bunch of time just to publish the response once... and then they can work on specific tickets and generate further FAQs as they come in.

Possibly, they are running around like headless chickens trying to fix their infrastructure - closing the stable door after the horse has bolted (with the keys to the house!!) - or they're all in meetings with their lawyers trying to make sure that the inevitable lawsuits don't make it to their personal doorsteps. What they're not doing is focusing on their customers.

Passwords are one thing, though, and typically easily changed. There are many other things held in here which can't be changed - government IDs, etc. - and the failure of the mSecure architecture means that everyone will need to be on their guard for some time.

Sadly, I feel that the demise of mSecure is going to be a case study in how to wreck a business in 24 hours. In the meantime, it's a massive PITA for all their customers.

Agreed. It's taken me five hours so far to change over passwords, starting with most critical first. I guess it's a hard lesson around entrusting a company in the modern age to data like this. And, let's be honest, with AI it's likely a matter of when the data is decrypted, not if. Assuming mSeven are telling us the trust - we have no way of knowing what has actually been leaked.

I think for anyone waiting for good news on this there isn't any. The only way to be safe is to take action and update passwords etc. starting now. And stop using the App. mSecure won't have a future following this, will fold the company and run for the hills. Not sure what else they can do - not that I condone it. The damage is done and our data is exposed irrespective.

I know this all sounds super negative - but we are not going to ever know if passwords have been exposed for sure. So, the only option is plan for the worst case as a security. I have so much critical data in my vault I'm kicking myself know for not thinking through what would happen in exactly this scenario.

And Iain makes a good point - the lawyers will be working to minimise the damage and personal liability here. If you read the T&C's for mSecure there are suitable get-outs, so unless gross negligence can be proved I doubt anything will come from any action anyone decides to take. Or who to take it against, when the company liquidates.

Right, back to hours more of password changing .....

Oh, and I made a post last night on the consumer rights, what happens and the timelines (legal) for handling a data breach under Oregon state law - and implications for those outside of the US. Part of this was that 45 days from the incident it is a legal requirement to explain what was taken, and when. So, if I understood the law correctly they don't have to respond (legally) yet. Never mind the GDPR rules that carry potentially massive fines for leaking the personal data for EU citizens - that also apply even if the company is US based.

...... interesting that the entire post I made was 'being checked by a moderator' and never got posted onto the forums.

Anyway, back to trying to limit the damage mSecure have caused. Subscription cancelled. App deleted. Sadly, I really liked the App and have been using it for years.

Ok, clear answer. It ‘only’ affect the people who had the (not so) bright idea to sync all their belongings to a cloud storage maintained by a relative small company. It means that when you never used that junk, you’re safe. It also means that you have more time to migrate data from msecure to another solution. And can focus on a smooth migration process instead of stressfully changing passwords, blocking stored cards, changing scanned ID’s etc.

BUT: WHY ISN’T THIS MESSAGE VISIBLE IN A CAPITAL FONT ON THEIR HOMEPAGE???? The whole IT world is buzzing about msecure and how NOT to handle a possible security breach. It can’t be that difficult, can it???

sidenote: we filed a ticket too, like probably thousands or more others. They could save themselves a lot of hassle with a public announcement. And they should have written precisely this in their initial correspondence. What a mess.

Ron Many thanks for the update.   

So it's only the people that sank to mSecure cloud thats a relief but sorry for those folks that use mSecure cloud. 

As you mentioned this should be public information on their website immediately

I based my conclusion on what I read here in this topic, on mails others received. So assuming that is all true, we’re ‘safe’. But msecure should publicly state that.

Do the "backups" go to msecure cloud? Anyone know? 

@Jason

officially not, but right now I don’t know what ground we’re standing on. This is an EOL company. Every hour silence means a bigger chance of an exit without any vital information.