This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

@Ben

And this is why mSeven aren't answering customer questions, but for any form of request, ticket or otherwise, they are cutting and pasting their lawyer-approved response. It's cowardly, without doubt, but therein lies the problem with litigation. mSeven is now totally defensive, even though that defensive posture is likely causing excess damage and distress to their customers. They will stay in that position until the dust, if not the lawsuit, has settled. But they can't offer any sensible degree of hope, either (a) because they know something we don't, and it's worse than they're admitting to, or (b) they genuinely just don't know, or (c) their lawyer has advised them that being helpful - sensible, even - exposes them to greater legal threat if they are then proven to be wrong.

Unlike LastPass, I doubt they'll make it as a business. They may not even want to.

I replied to their standard response on my ticket with this:

Can you elaborate on how difficult it would be for the unauthorized actor to be able to access the confidential information in the encrypted copy of the database? Would a user's master password be sufficient? Are you confident that they did not acquire the encrypted 46 character account keys used for setting up a new device?

If the randomly generated account key wasn't involved in the exfiltration then if I understand well things are much brighter.

The BIG (and very stupid basic mistake) that seems to be made, is that the LOCAL password is automatically set to be the CLOUD password also. That explains why you can’t change your master password in offline mode. I and probably no one ever realized this was the case. It ALSO means that if msecure flips the switch regarding syncing to their stupid cloud (which they DID in the past!), we all might have (traces of) old vaults on a compromised server. Without knowing, that is.

I have no idea what stuff they smoke at their headquarters (attic?) but it must be quite strong. Otherwise they would have had their head cleared and replied. It is now news all over the world in nearly every tech- and security publication. And the main news is not even so much a (possible?) security breach, but the fact that msecure went completely dark. That is unheard of and the general advice mostly is to abandon ship immediately. Because obviously, this company is for whatever reason not able to handle scenarios like these. Very sad, because the software itself was user-friendly and offered all the options needed.

Moving to another (commercial) alternative is essentially useless. Near all of them require cloud-backups or are cloud only, with basically local software in the shape of a minimalistic browser. KeePass seems to be the most obvious alternative, being open source and all. It is a bit less user-friendly but fully local. Problem here is, that there is no official mobile version for iOS or Android. Some recompiled the code and offer a (slightly different named) app. But then you’re essentially back at square one: can you trust this developer?

Call me stupid but for convenience I'm just looking at BitWarden as an alternative and it's nothing like as good as mSecure.  Loads of wasted screen space, hardly any templates (not even one for a bank account!) adding custom fields (because there's no usable template) puts them all at the bottom of the list (off the screen) etc etc

@David.

I'm also looking for an alternative, similar complains as you about usability.

On the other hand, I can survive with some painful user interface, but security is not negotiable.

@David, @Vinicius

I've given up on the offerings from outside.

So, I've spent half a day with FileMaker Pro, local-only AES-256 encrypted database, simple sync between devices running FileMaker Go, UI to suit exactly what I want - and customisable going forward. As a former programmer with security training, I generally hate roll-your-own solutions, but in this case I've decided that it might be safer after all than relying on external developers who seem more focused on convenience and justifying subscription model pricing rather than security.

I already have NordVPN so I can use Nordpass at no extra cost. Has excellent reviews and apparently uses zero knowledge architecture. Had a quick play with it and seems to work well. Lacking any programming skills probably not a good idea for me to go down the path of developing my own secure database as some have suggested but a good idea if you can. 

Due to very poor communications from Msecure about the  specific details and about what was actually taken, after many years I will have to go elsewhere. 

@David,@Vinicius,@Iain

I'm hoping to be ok as I've synced via iCloud, however I've been looking around at other offerings.

I've been using Apple Passwords in parallel with mSecure for a while, it works well, but doesn't have the other useful features of mSecure.

As I have NordVPN, I'm checking out NordPass at the moment, it has many options for importing records from other password managers, but not mSecure unfortunately.

I'm not very familiar with spreadsheets / CSV files, but I exported just a few records from mSecure to check out, but found the format odd, not what I expected compared to an export from Apple passwords. This is starting to look like a massive job to sort out.

Any advice would be welcome, thanks.