This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

@John may I ask you  how you used to synch? Thanks

@Maurizio - cloud, unfortunately.  

@John you mean mSecure cloud? 

@Marurizio - sorry, yes. 

Ok, thanks. In any case, I’m not convinced that the problem is truly limited to those who use this synchronization—which is what they claim in their famous standard message sent *only* to those who reach out with a query, whatever the content of the query is. If that were actually the case, why not to proactively broadcast this information to everyone? Unfortunately, looks like they are still in the darkness

Remember when they had so much trouble with the subscription renewals? I wonder if that is connected to this somehow.

I am quite sure by now that the breach is limited to ‘only’ their cloud customers. And I am getting more and more the idea - after talking to some people I know from my IT-environment based work - that the breach regards possibly only a user database with maybe hashed passwords. Those in themselves are generally useless unless you had a master password like 1234. HOPEFULLY msecure did not store credit card data unencrypted, or phone numbers and addresses. But chances are that msecure does not even have that much user data anyway, especially not from customers who bought the app in an app store.

Nevertheless, by now they should at least communicate to users from whom msecure knows with certainty that they AND used the cloud AND whose data was stolen. If the hackers only stole vaults, without a password these are useless.

And no: it is NOT good practice (far from that) to advice your customers to blindly change passwords in full panic mode. Most clients will not have red the initial mail very well, and for sure have not understood it well. Which means that they probably are changing the passwords from within the application AND syncing with msecure still on. In that scenario, you will have to do it all over again in a few days.

I will give it a few days more and without any clarity will start the cumbersome process of moving to Keepass (open source). There is a Keepass compatible app for iOS too (Keepassium). It’s all based on a rock solid secure system. But yeah, ten years ago that wasn’t available for mobile devices. Otherwise that would have of course been my first choice.

Well if mSeven had been more forthcoming with info I could maybe have stuck with them as I've never used the cloud sync but the lack of any meaningful communication days later is a definite deal breaker.

After a pretty exhaustive search for a replacement I've finally gone with Enpass. My main criteria was option to do local storage only and have wifi sync between devices. Also apps for Mac desktop and iOS and import of CVS file. Enpass was the only one that satisfied all of my requirements. They mostly get good reviews with one of the complaints that lowers their score is not great Auto fill of forms. Not a deal breaker for me at all. 

It did a great job of importing my mSecure CVS file. When exporting from mSecure make sure all entries are selected and then when setting up Enpass make sure you select import from previous password manager and select mSecure then the CVS file. Don't just select CVS file. This way it seems like most all the fields are properly maintained. I did try and drag and drop the CVS file but didn't seem to like that so then selected it in the browser and worked great. They have very clear instructions in their help center.

Just my 2 cents your ymmv 

@Andrew

Ehm… did you check the country of origin of this app…? For me it would mean that all alarm bells would go off.

@ron

Well the apps been around for 12 years  without one reported incident on the whole WWW so seems pretty safe to me. Especially if they are never getting my data. 

Aslo AI has this to say: "Independent Audits & Compliance: Enpass is SOC 2 Type II audited, ISO 27001:2022 accredited, GDPR compliant

Testing Posting still working. Seem to have stopped

Just posted re couple of other options for wifi  sync and the post has not appeared got a messages saying your post will appear once its been approved so they obviously screening/blocking posts. 

@Ron

I've made some tests observing the mSecure internet traffic in a new setup with Dropbox synchronization.
The tests are not conclusive, but gave me a clear picture.
Based on these tests, I cannot rule out potential risks involving iCloud or Dropbox.

I'm not trying to increase the already existing concerns about mSecure breach.

However, based on the limited information they are willing to share about the event, I assume the worst.

I'd recommend not creating a false sense of security based on no concrete evidence against it.

I've submitted specific questions about what data is stored in their servers (specially the mentioned database) for users using other means of synchronization, but they replied with the generic answer - similar to many of users commented here.

Like many users here, I've trusted mSecure for several years, but I've already made my decision to move to another solution.