mSeven Software mSecure customers face credential risks after encrypted database theft
TL;DR
A hacker reportedly stole an encrypted database from mSecure Cloud holding information on current and former mSecure users. mSecure uses AES-256 encryption, but mSeven Software urges customers to change stored passwords, reset or re-enroll 2FA, and remove existing passkeys. Support says only users who synced with mSecure Cloud are affected.
What happened
mSeven Software notified current and former mSecure customers on November 3 that it had recently learned of suspicious activity involving its password manager and had engaged external cybersecurity experts. The company has not publicly explained how the breach occurred, but support replies shared by customers say a hacker stole an encrypted database from mSecure Cloud that held information on current and former users. Support also said the issue only affects users who synced with mSecure Cloud, that there is no evidence the attacker accessed confidential information inside the encrypted database, and that additional security measures are now in place.
The notice urged customers to immediately protect confidential information in their password manager, which may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys. Support said there is no evidence the app is currently unsafe to use. BleepingComputer asked mSeven about the incident but had not received a response at publication.
Why it matters
mSeven's documentation says mSecure uses AES-256 encryption and a zero-knowledge architecture that encrypts data on users' devices before upload, and the company says it cannot access decrypted vault contents. A stolen encrypted database is still a high-risk event, because attackers can try to crack weak master passwords through offline attacks. If a master password is weak, the passwords, passkeys, financial information and other sensitive data in that vault could be exposed. This mirrors the 2022 LastPass breach, where stolen encrypted vault backups were later linked to cryptocurrency thefts after attackers reportedly cracked weak master passwords.
Who is affected
- Current and former mSecure customers whose information was in the stolen mSecure Cloud database.
- According to mSeven support, only users who synchronized their data with mSecure Cloud.
What to do now
- If you synced with mSecure Cloud, change the passwords stored in your mSecure vault.
- Reset or re-enroll the two-factor authentication (2FA) methods saved in the vault.
- Remove existing passkeys stored in the app.
- Watch for further notices from mSeven, since the company has not publicly explained how the breach happened or how many users were affected.
What we don't know yet
- How the attacker reached the mSecure Cloud database and which systems were compromised.
- How many current and former users and records were affected.
- Whether attackers have already cracked any master passwords through offline attacks.
Sources
