mSecure password manager says an intruder copied an encrypted database

The message landed on November 3 in the inboxes of current and former mSecure customers. The publisher of this password manager, mSeven Software, refers to "suspicious activity." It asks them to change their passwords, reset their two-factor authentication and delete any saved passkeys. The text was sent to BleepingComputer, which relayed it on November 4. It says neither what was affected nor how many people are concerned.

The details came through another channel. On mSecure's support forum, users copied the standard reply they get from support. An unauthorized person reportedly "acquired an encrypted copy of a database" containing information about current and former users. The publisher says it has no evidence that confidential content was accessed. According to the company, only users who synced their data with its online service, mSecure Cloud, are affected.

Can an encrypted vault be opened?

On paper, the protection is solid. According to mSeven's documentation, mSecure encrypts data with AES-256 directly on the user's device, before anything is sent. The publisher says it never sees the contents of vaults in clear text: this is the so-called "zero-knowledge" principle.

But an attacker who holds a vault can attack it at home, with no time limit and no cap on attempts. BleepingComputer recalls the LastPass precedent: in 2022, encrypted vault backups were stolen, then later linked to cryptocurrency thefts. Everything then depends on the strength of the master password. A short password, or one reused elsewhere, could fall. A long, unique passphrase holds up far better.

Several questions remain open. How did the intruder get in? Which information in the database was not encrypted? When did the theft take place? BleepingComputer says it asked mSeven and had received no answer at the time of publication.

Customers learning about it through support

On the forum, irritation dominates. Several users criticize the publisher for publishing nothing on its website and for answering every request with the same copy-pasted text. One customer of ten years says they are leaving. Others ask whether iCloud backups or Wi-Fi sync are affected: no official answer appears in the discussion.

What to do if you use mSecure

There is no need to wait for the end of the investigation: the publisher's instructions are enough to reduce the risk, provided you follow them in the right order.

• Change your master password first and choose a long passphrase that you use nowhere else.
• Then change the essential passwords stored in the vault: email, banking, work accounts, admin access to your sites and servers.
• Reset your two-factor authentication methods and replace your passkeys, as the publisher requests.
• Be wary of messages claiming to come from mSecure or mSeven asking you to "verify" your account.
• If you did not use mSecure Cloud sync, the publisher says you are not affected. Changing the master password is still a low-cost precaution.

One question remains that only mSeven can answer: how many vaults were in the copied database? Until the publisher publishes something, its customers have to make do with a support reply.