I've just signed up for 1Password and spent the better part of this afternoon migrating over.  This is the cost of inaction and no comms - you lost lifelong customers in a day.

After over 20 years of loyal mSecure use, I am shocked at how this is being handled. I didn't even get the notice of the data breach, but my two teenage sons did (I added them to a family plan in July). The radio silence from mSeven is telling. For all we know, the execs are on a beach in the Bahamas by now.

At this point, it's beyond unreasonable to not even give us a 'we don't know but are working to find out' notice. For those that don't take any action this is going to have a grim result when  (if) we find out it's been a major breach. As stated on this forum, this will be a text book example of how to NOT handle a data breach, and lose your customer base and product in 24 hours. Sad end to a decent App and product.

The only upside is how many accounts have 2FA now, giving some protection. 

For everyone on this forum - if you do nothing else I implore you to at least change the password for your email(s), and your AppleID if you are an Apple user.

They aren't in the Bahamas as best as I can tell. I received a response finally about 4 hours ago. This appears to be related to a security breach that resulted in an encrypted database being "acquired" by an unauthorized individual. The key information they provided me was this, "Please note, this issue only pertains to users that were synching with the mSecure Cloud.". Based on this it sounds like if you were not using mSecure Cloud for sync that this shouldn't impact you. I would still suggest reaching out to their support via ticket/email so you can ask questions related to your individual situation. I think this also leaves some explaining on mSeven's part about how this ultimately happened and whether or not the advertised security design truly matches reality in this scenario. It does sound like they are getting their teeth kicked in from the response to this event. I've been in a few outage/security breach situations in IT and can appreciate how hard responding to a situation like this can be, especially for a small team. While I have been disappointed in the delay in getting more information during the last 24 hours and now have questions about the security design of the mSecure Cloud sync feature. I do think they are trying to get back to users as quickly as they can. I've been with them for 15 years so I'll give them the benefit of another couple of days in the hopes more clarity comes out of this and I can make an informed decision on how to proceed. I wasn't using mSecure Cloud so hopefully the comment in the response I received is accurate and my situation isn't as dire as I originally believed. Regardless, I'm hoping mSeven will provide more details information publicly so we can all know where things stand with this incident and our data.

@Thomas, I hope your trust does not come back to bite you. I have been syncing to the mSecure Cloud for well over a decade and I did not receive a notice of this breach. I also logged a ticket on Tue 11/3 at 6:30am within minutes of learning about it. No reply yet. Were it not for the fact my sons received the notice, I would still be using my mSecure app as if nothing had happened. I have now migrated over to 1Password and deleted mSecure entirely, as has my entire family. 20+ years of trust down the drain. And the fact their website still says nothing about this breach -- it should be written in large neon letters at the very top -- is highly unethical. 

Could you (mSecure) provide more detail on the breach and if we need to reset EVERY password in our mSecure account?

Given the mSecure data's AES 256 is HEAVILY encrypted to where even a super computer would struggle.   If I change my password and use 2 factor authorization, wouldn't that solve the security problem?

Received the following email from mSecure Support this morning (Note: I am still amazed at how long it took for any useful information to be provided:

Yesterday, mSeven Software (“mSeven”) learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application. Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.

In immediate response to learning this information, out of an abundance of caution and in the interest of candor, mSeven notified current and former mSecure customers and provided as much information as was reasonably available at that time.

As a standard best practice, mSeven continues to recommend that mSecure customers change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys and any other sensitive information. This should be a part of all routine security practices. However, as stated, the database involved was encrypted and mSeven has no evidence that the unauthorized actor has accessed the confidential information stored therein.

We have taken steps to bolster security to help prevent future unauthorized activity. Unfortunately, deleting mSecure will have no impact on this situation. However, as stated, the database that is involved is encrypted and mSeven has no evidence that the unauthorized actor has accessed the confidential information stored therein.

Please note, this issue only pertains to users that were synching with the mSecure Cloud.

mSeven takes the security and privacy of all information stored on the mSecure platform very seriously and has no evidence that mSecure is not currently safe for use. Our support team is working as fast as possible to respond to customer questions. We take your trust in us seriously, and appreciate your patience and continued support.

Sincerely, 

The mSecure Support Team

Oddly, although I did get mSecure's first message 24 hours ago, I have not received this latest one.  They appear to be disorganized.

@Kristin The reports say backing up to iCloud was not compromised.  Only backing up to MSecure's own cloud was impacted.  If that is correct you should be OK.

Also people should note that your passwords are not readily available to the hacker.  If you backups were in MSecure's cloud back up storage then someone has your encrypted backup.  They would need to decrypt that backup to access your passwords.  

The email I received was in response to a support ticket - I have not seen a email sent to all users

If it is just their cloud database that was obtained, yes it should be fine... only thing is that wouldn't be such a security risk.  I.e. if someone said "here's an encrypted database or table I downloaded from your server" it's not that big of a deal.  If however they said here is the database we downloaded with a few decrypted records, yes that would be huge and we just don't know because mSecure aren't saying anything yet.

My main concern is the app itself is compromised, i.e. they accidentally used a 3rd party library which poorly implemented encryption so it's breakable (more likely) or blatantly spewed unencrypted data from the app to an attackers (less likely but I've seen this exact hack happen twice already) 

It doesn't explain how they got hold of the data from msecure servers... if that's all they've done, again it isn't that serious but doesn't explain the deafening silence when we are looking for details.

Why, why oh WHY they don’t share this information publicly??? In essence, this would mean that anyone who did NOT use their cloud is safe. And even IF you used their cloud: WHAT was stolen? A database with useless hashes or much more?

I start to slowly think this wasn’t such a big deal after all. HOWEVER, that conclusion can and should only be based on hard facts. And these we simply don’t get. What msecure also seems to forget in all it’s innocence is the fact that private indivuduals and companies stored attachments in their vault. Think business contracts, scans of passports, creditcards and a lot of other sensitive data. THAT is not changeable. When stolen, we’re in deep shit. And the costs will be monumental, possibly haunting us all for the rest of our lives.

Msecure should have NEVER setup this cloud. Clientrs that use msecure are mostly the little more privacy-aware ones. They chose msecure for its local character. The moment their cloud was announced, people didn’t like it because of possible breaches. They were - of course - right. In hindsight, the appearance of their cloud should have been the moment we all moved to elsewhere. Because it broke the ‘local only’ rule. As far as we know, we never used this cloud. However: did msecure sneakily copy stuff to there? The only ones who can answer this question are at msecure. And they seem to be gone.

Why would they secretly share offline data with the cloud? And is there any reason to believe that using the extension raises any additional risks (for people like me who don't back up to the mSecure server, but only store data offline)?