Additional information on what was obtained by the "unauthorized actor" who "acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application" is critical. But it is unlikely that mSecure will share this information. The only new information received was that it involved the mSecure Cloud Storage.

@Paul

I suspect the only thing stolen was a master password list containing ONLY hashes. With that alone - even in combination with encrypted user vaults - no criminal can achieve anything. HOWEVER if msecure was so stupid to have an unencrypted database of the true user passwords, that’ll be a scandal that will resonate in the security world for years to come. But even that extremely bad scenario would ONLY affect msecure cloud users.

I work for 35+ years in IT, partly security. I never experienced a company that handles communication so badly as msecure. And believe me: I have seen a lot in my life. This what’s going on now is extremely exceptionally unsafe and unprofessional behavior. We can only guess why they behave like they do. But the longer they keep silent, the bigger the chance that something from probably inside went wrong.

If the local software itself was compromised, then msecure would have mentioned that in their scarse farts of information. They didn’t. The focus is on their cloud-infrastructure. And only customers who synced their stuff to that are affected. Changing passwords like a headless chicken is relatively useless. Especially since if users let the sync enabled, it doesn’t change anything. The potential risk is still there, because no one there seems to know what it is. 

I don't like the fact that you need an internet connection to change the master password...

@Ron 

Agreed - The first thing I confirmed was that my critical accounts were protected by two-factor authentication that is independent of mSecure. Also changed the Master mSecure Password.

Can somebody explain what the "Master password is?" I use mSecure offline. I have a password to open the the app on my computer and phone. I also  have a separate password that I use to access my online account for mSecure. Which one is the "master password.?" If the master password is the one I use locally, I suppose that it wouldn't help somebody who accessed mSecure's server since in order for them to use it,  they would have to have physical access to my computer. Right?

@Dangrossmanmedia What do you mean by "I use mSecure offline"? Do you cut the internet connection before opening mSecure? The master password is the one you use when you open the app.

Thanks for asking for that clarification. I have my internet connection going. But I do not store my passwords on mSecure servers. I only store them locally, or at least that's my intention. So is the password that I used to open the app shared with mSecure? If so, is that a problem, given that as far as I am aware, my data is not otherwise shared with mSecure servers.

@ Dangrossmanmedia Try to change the password offline (without an internet connection) and you will find the answer (I think)...

 @Luciano Good idea. The answer is that I cannot change my password for opening the app without an internet connection.

mSeven abandoned all of us mSecure customers by not explaining what happened. We need to return the favor!

Go to Google Play and/or the Apple App store. Post a review on mSecure. Post your comments about how the company has a lack of transparency when it comes to security and cybersecurity is not their top priority. That if you do not want to risk password security, do NOT purchase this app.

See if we can get that app rating WAY down from the 4.5 on Google and 4.8 on Apple. That will help after all this is over. I would not put it past their legal team that they were told to just lay low and wait till it all blows over since they can simply just start selling their product again when everyone forgets...

P.S. I just posted my review on Google Play. For Google, if you posted a review/rating before, then you cannot post another. Not sure how Apple handles that. I had to go into my Google account, manage apps and then find the app to delete my old review so I could post a new review. I could have edited my old review but I am not sure if the date changes or stays the original date.