Good morning all,

I run the Cyber Security team for a well known Bank in the UK. I don't have any inside info about this but wanted to share what I was sent by mSecure team in case in helps with your triage of password resets. 

"Earlier this week, mSeven Software (“mSeven”) learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application. Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.

In immediate response to learning this information, out of an abundance of caution and in the interest of candor, mSeven notified current and former mSecure customers and provided as much information as was reasonably available at that time.

As a standard best practice, mSeven continues to recommend that mSecure customers change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys and any other sensitive information. This should be a part of all routine security practices. However, as stated, the database involved was encrypted and mSeven has no evidence that the unauthorized actor has accessed the confidential information stored therein.

We have taken steps to bolster security to help prevent future unauthorized activity. Unfortunately, deleting mSecure will have no impact on this situation. However, as stated, the database that is involved is encrypted and mSeven has no evidence that the unauthorized actor has accessed the confidential information stored therein.

Please note, this issue only pertains to users that were synching with the mSecure Cloud.

mSeven takes the security and privacy of all information stored on the mSecure platform very seriously and has no evidence that mSecure is not currently safe for use. Our support team is working as fast as possible to respond to customer questions. We take your trust in us seriously, and appreciate your patience and continued support."

@Paul

That is the same information that they are providing to all users who either (a) submit a ticket, or (b) provide feedback to their web pages. 

Note that this is request/response only: they have no proactively stated this on their website, nor have they sent this as a follow up email to the original, loosely-worded disastrous communication that caused everyone so much grief.

The challenge with this particular communication is the legalese and the continued level of omission. Don't get me wrong, I would expect this: it is clear that mSeven's lawyers are in play here with an eye on potential litigation. We can all understand that.

But there is a complete lack of definitive content that would leave users reassured.

For example, note that there is no definitive statement that the "unauthorised actor" doesn't have access to the key(s) to the "encrypted" database. There's no definitive explanation that, if customers' data is inside that database, then the customers' database is encrypted with a key that differs from the database itself, and again that the "unauthorised actor" doesn't have access to that key.

Note also the use of "unauthorised actor". It is not clear that this is not someone who might previously have been authorised - that is a former employee - who might or might not have had access to keys that would enable it to be decrypted. 

Furthermore, they do not reveal who might be at risk. For example, if you tried their mSecure Cloud once, did they retain a copy of your data even if you switched back to syncing via one of the other methods. The risk here is that someone who, perhaps, trialled this is exposed, even though they haven't used it.

As I said, there is a lot of omission in this statement. It is, unsurprisingly, a bare minimum, because the more that mSeven reveal, the more they open themselves up to legal attack.

I'm not some panicking idiot, by the way. IF the database was encrypted, and IF the encryption was AES-256, and IF the keys were properly protected (and not accessed), and IF the "no knowledge" architecture hasn't been compromised by their tinkering with trying to implement their (unnecessary) own mSecure Cloud, then there is no need to run around like a headless chicken. 

The problem is that mSeven's reticence to be open and honest makes those IFs rather too dangerous right now. It is this lack of honesty, and lack of apology, that I think makes a lot of mSecure's users feel so worried right now.

And ultimately, it is this lack of openness and honesty that will finish them. When you work in cyber security, as you do, you know that trust is everything.

And there is just no trust left.

Totally agree. I had posted this before seeing others had helpfully also posted this. It falls short in a number of areas but does provide some more information than the blanket email (whether you believe it is a slightly different matter but its a data point).

Most of my work is Cyber related, but more recently I have been incident coordinator/leader for my employer. We have whole teams dedicated to how we manage our customers and regulatory comms during an incident. We are already looking at this internally as a case study in how not to perform comms and the damage to the brand that can happen with an absence of information.