mSecure password manager urges reset after cloud database cyberattack

mSeven Software has issued a security warning to current and former customers of the mSecure password manager, urging them to immediately change their master passwords, reset two-factor authentication, and remove existing passkeys following a cyberattack.

• mSeven Software detected suspicious activity affecting the mSecure application.
• An encrypted customer database from mSecure Cloud was reportedly stolen.
• Users are strongly urged to update credentials and reset 2FA settings.

Details of the Security Incident In a notification sent to customers, the company stated it recently discovered suspicious activity and launched an investigation with the help of external cybersecurity experts. However, the initial notice did not disclose how many users were impacted or precisely how the systems were compromised. Customer support responses later indicated that a hacker had stolen an encrypted database belonging to mSecure Cloud users. The company stressed that it currently has no evidence that attackers accessed the actual confidential information stored inside those encrypted vaults.

Zero-Knowledge Architecture and User Concerns mSecure utilizes AES-256 encryption and a zero-knowledge architecture, meaning data is encrypted locally on users' devices before being transmitted, and the company cannot access decrypted vault contents. This setup initially caused confusion among users as to why a password reset was necessary if data was already encrypted. Security analysts point out that stolen encrypted password vaults can still pose significant risks if attackers manage to crack weak master passwords through offline attacks, a scenario reminiscent of the 2022 LastPass security breach.

Implications for Users and Security This incident highlights the critical need for strong master passwords when using any credential management service. While mSeven has implemented additional security measures and maintains that the application remains safe to use, the lack of complete transparency regarding the breach has drawn criticism from privacy-conscious users.