Password manager mSecure sent its customers a worrying email this week. The maker, mSeven Software, says it “recently learned of suspicious activity” tied to the app.
It then told people to act right away. Yet the email explains almost nothing. Customers now face a long to-do list and very few answers.
What the Email says
The message went out on Tuesday to current and former customers. First, mSeven says it started an investigation. It also took steps to cut the risk and hired outside security experts. However, it did not name the steps or the experts.
Next came the warning. The firm has advised customers to keep any personal information saved in the app safe. It could be through changing passwords, resetting two-factor codes, or deleting passkeys. The email ends with a short apology for the trouble.
Security researchers, including Brian Krebs, shared the notice online. The same text also appears on mSecure’s support forum.
The company hasn’t revealed what actually transpired
The gaps are big. The email does not describe the activity or say when it began. It also skips how many customers it hit. Most importantly, it does not say whether attackers broke into company systems or opened any vaults.
The wording is loose, too. “Passwords” could mean your mSecure account password, the logins inside your vault, or both. The same question applies to the two-factor and passkey steps. The company, mSeven, has yet to supply answers for all these as of the time of writing.
Customers are frustrated. One forum user said they keep more than 800 passwords in the app. They asked whether they must change every one. Some would like to know whether vaults stored solely on one’s device are as vulnerable as those stored in the cloud. This is important since mSecure has an option for cloud, Dropbox, iCloud, or Wi-Fi synchronization.
Why encryption is important
mSecure says it scrambles vault data on your device before syncing it. The company says even its developers cannot read what you store. Its app store pages also promise AES-256 encryption and a “zero-knowledge” design, according to the tech site heise.
If that design works as described, stolen scrambled data would not automatically reveal your logins. So why the blanket reset? One possible reason is the new version. mSecure 7 can store passkeys and two-factor codes next to passwords.
Concerns about how technology companies handle sensitive user information extend beyond password managers. Xiaomi has also faced privacy claims over its collection of app lists, usage data, and screen recordings. The allegations raise further questions about how Xiaomi handles users’ personal data.
Some security writers think mSeven either cannot rule out exposure or is playing it safe. Nobody outside the company can say which is true.
German officials review mSecure and other password managers
Last December, Germany’s Federal Office for Information Security, known as BSI, tested ten password managers. mSecure was one of them. The agency found that the maker could, in theory, reach stored data. It also said the design fell short of what people expect from a password manager.
Some limits apply. BSI tested only mSecure 6.1.5 for Android, and later updates may have changed the results. The company now offers version 7. Also, no report we found links the BSI findings to this incident. Nonetheless, the review helps customers to raise more questions.
Secure your accounts
First, confirm the email is real. A forum user has already asked whether it was phishing. Do not click links in the message. Instead, visit mSecure’s support site yourself, where the notice also appears.
Next, start with your most important accounts. Think email, banking, and work logins. Use a device you trust. Then change each password on the site itself, not inside mSecure.
After that, generate fresh codes for all accounts whose codes are stored in mSecure. When codes sit next to passwords, a thief with vault access could skip your second step. Remove stored passkeys as well, and generate new ones on each site.
Be careful when resetting your account entirely, since it will delete your cloud data and disable your account on all devices, according to mSecure’s own help page. Backup first. In addition, be prepared for scam emails as attackers will often replicate any such breach news.
Last but not least, be careful about storing logins using the app itself. Many users have asked whether it is safe to do so, but no response from mSeven yet.
What’s next
As of Wednesday, we found no public update from mSeven. One report says the company had also posted nothing on its X and Facebook pages by Tuesday evening. A password manager is a keeper of the keys to someone’s entire digital world, which is why keeping silent about an attack quickly diminishes any trust that people have.
Customers need clear answers from the company. mSeven needs to clarify exactly what happened, whether it affected anyone or if the attacker stole vaut data. Until then, treat everything in your vault as exposed. That is more work. Even so, it costs less than a stolen account.
