Additional information on what was obtained by the "unauthorized actor" who "acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application" is critical. But it is unlikely that mSecure will share this information. The only new information received was that it involved the mSecure Cloud Storage.

@Paul

I suspect the only thing stolen was a master password list containing ONLY hashes. With that alone - even in combination with encrypted user vaults - no criminal can achieve anything. HOWEVER if msecure was so stupid to have an unencrypted database of the true user passwords, that’ll be a scandal that will resonate in the security world for years to come. But even that extremely bad scenario would ONLY affect msecure cloud users.

I work for 35+ years in IT, partly security. I never experienced a company that handles communication so badly as msecure. And believe me: I have seen a lot in my life. This what’s going on now is extremely exceptionally unsafe and unprofessional behavior. We can only guess why they behave like they do. But the longer they keep silent, the bigger the chance that something from probably inside went wrong.

If the local software itself was compromised, then msecure would have mentioned that in their scarse farts of information. They didn’t. The focus is on their cloud-infrastructure. And only customers who synced their stuff to that are affected. Changing passwords like a headless chicken is relatively useless. Especially since if users let the sync enabled, it doesn’t change anything. The potential risk is still there, because no one there seems to know what it is. 

I don't like the fact that you need an internet connection to change the master password...

@Ron 

Agreed - The first thing I confirmed was that my critical accounts were protected by two-factor authentication that is independent of mSecure. Also changed the Master mSecure Password.

Can somebody explain what the "Master password is?" I use mSecure offline. I have a password to open the the app on my computer and phone. I also  have a separate password that I use to access my online account for mSecure. Which one is the "master password.?" If the master password is the one I use locally, I suppose that it wouldn't help somebody who accessed mSecure's server since in order for them to use it,  they would have to have physical access to my computer. Right?

@Dangrossmanmedia What do you mean by "I use mSecure offline"? Do you cut the internet connection before opening mSecure? The master password is the one you use when you open the app.

Thanks for asking for that clarification. I have my internet connection going. But I do not store my passwords on mSecure servers. I only store them locally, or at least that's my intention. So is the password that I used to open the app shared with mSecure? If so, is that a problem, given that as far as I am aware, my data is not otherwise shared with mSecure servers.

@ Dangrossmanmedia Try to change the password offline (without an internet connection) and you will find the answer (I think)...

 @Luciano Good idea. The answer is that I cannot change my password for opening the app without an internet connection.