Additional information on what was obtained by the "unauthorized actor" who "acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application" is critical. But it is unlikely that mSecure will share this information. The only new information received was that it involved the mSecure Cloud Storage.

@Paul

I suspect the only thing stolen was a master password list containing ONLY hashes. With that alone - even in combination with encrypted user vaults - no criminal can achieve anything. HOWEVER if msecure was so stupid to have an unencrypted database of the true user passwords, that’ll be a scandal that will resonate in the security world for years to come. But even that extremely bad scenario would ONLY affect msecure cloud users.

I work for 35+ years in IT, partly security. I never experienced a company that handles communication so badly as msecure. And believe me: I have seen a lot in my life. This what’s going on now is extremely exceptionally unsafe and unprofessional behavior. We can only guess why they behave like they do. But the longer they keep silent, the bigger the chance that something from probably inside went wrong.

If the local software itself was compromised, then msecure would have mentioned that in their scarse farts of information. They didn’t. The focus is on their cloud-infrastructure. And only customers who synced their stuff to that are affected. Changing passwords like a headless chicken is relatively useless. Especially since if users let the sync enabled, it doesn’t change anything. The potential risk is still there, because no one there seems to know what it is. 

I don't like the fact that you need an internet connection to change the master password...

@Ron 

Agreed - The first thing I confirmed was that my critical accounts were protected by two-factor authentication that is independent of mSecure. Also changed the Master mSecure Password.

Can somebody explain what the "Master password is?" I use mSecure offline. I have a password to open the the app on my computer and phone. I also  have a separate password that I use to access my online account for mSecure. Which one is the "master password.?" If the master password is the one I use locally, I suppose that it wouldn't help somebody who accessed mSecure's server since in order for them to use it,  they would have to have physical access to my computer. Right?

@Dangrossmanmedia What do you mean by "I use mSecure offline"? Do you cut the internet connection before opening mSecure? The master password is the one you use when you open the app.

Thanks for asking for that clarification. I have my internet connection going. But I do not store my passwords on mSecure servers. I only store them locally, or at least that's my intention. So is the password that I used to open the app shared with mSecure? If so, is that a problem, given that as far as I am aware, my data is not otherwise shared with mSecure servers.

@ Dangrossmanmedia Try to change the password offline (without an internet connection) and you will find the answer (I think)...

 @Luciano Good idea. The answer is that I cannot change my password for opening the app without an internet connection.

mSeven abandoned all of us mSecure customers by not explaining what happened. We need to return the favor!

Go to Google Play and/or the Apple App store. Post a review on mSecure. Post your comments about how the company has a lack of transparency when it comes to security and cybersecurity is not their top priority. That if you do not want to risk password security, do NOT purchase this app.

See if we can get that app rating WAY down from the 4.5 on Google and 4.8 on Apple. That will help after all this is over. I would not put it past their legal team that they were told to just lay low and wait till it all blows over since they can simply just start selling their product again when everyone forgets...

P.S. I just posted my review on Google Play. For Google, if you posted a review/rating before, then you cannot post another. Not sure how Apple handles that. I had to go into my Google account, manage apps and then find the app to delete my old review so I could post a new review. I could have edited my old review but I am not sure if the date changes or stays the original date.

How about we just take a deep breath and be reasonable. There is no need to condem a company when you don't know what is actually happening. Save the critical reviews till you have all the facts from them first.

Changed the most vital privacy- and finance related accounts. For the rest we users MUST get clear answers from msecure asap. Otherwise there will be many court cases ahead for them. But as said before: probably the team/individual behind mseven deleted as much evidence as possible and switched of the lights. Hopefully we will somehow get to know what exactly happened. I think it was ‘just’ some compromised user data from their cloud. Probably very low risk. But since they probably never trained for a situation like this one, they panicked. Or got ‘hijacked’ by a lawfirm who adviced the, to shut up. US laws are very different from for example EU laws, so many from the continent will even understand less of what is going on. I do know however that since they sell there software in the EU, within 72 hrs they had to inform authorities here. If they didn’t the fines are huge (starting at 25 mln dollars or so). 

I really do not understand why all the secrecy is there. Maybe they want to do their research and not leak potential information to the thieves. But then again: they should at least let us OFFICIALLY know which user group is affected. This, they do only via mail tickets. In those mails it’s clear that it’s only customers of their own cloud. So that essentially is of huge importance to a large base of users. It means that for non-cloud users there is no problem at all.

if they only would have jumped in here and explain THAT, life would already have been a lot easier. I can’t follow their train of thoughts, never ever saw this behavior anywhere else in my career. Maybe there was a physical breach in their office, maybe it was an employee that went rogue, maybe they are under criminal investigation and is their office a no-go area. All possible at this moment.

Desde luego el helpdesk es penoso, aquí no contesta nadie.