This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

@Klaus, @Ben

Is there some way to ‘prove’ this as an official response…? Not that I don’t trust you, but in cases like these you can’t trust many ;-)

It for sure is THE answer people that disabled the dreaded msecure cloud and never used it are waiting for. Completely ununderstandable that this is not shared on msecure’s website. I am under the strong impression that the maker(s?) don’t even read these forums at all.

Incredible amateuristic and a textbook example for the books regarding how to NOT handle a problem in your company. Silence is killing your product, whatever it is.

Another thread in this forum shows a user receiving a response from mSecure after submitting a ticket.  I submitted a ticket earlier yesterday and haven't received a response.  They say this only affects people who were syncing to the mSecure Cloud.   They also said deleting your data won't do anything (probably their way to hold on to customers).  We moved off mSecure as of yesterday.  Unacceptable.  

Hello.

I raised this ticked to the support:

"Provided that your silence on that issue is far from being acceptable, some users reported they received messages from you  asserting that this "possible issue" is - in case - affecting ONLY users using mSecure Cloud as sync method.

So like many I'm moving on.  Have to assume there was exfiltration of our stored data, which is bad but with a strong enough master password not immediately catastrophic.  Have set up Vaultwarden for local control over this, and will slowly migrate over in the coming weeks.  Importing from msecure CSV's is a disaster because the records are so ragged.  In the interim I've turned off the cloud storage on msecure so any incremental changes are at least kept local.

It would be great if they could share the full shape and contour of the problem so we better understand where the exposure might be, but the biggest likelihood imo is that there were password vaults exfiltrated.  My password happened to be exceptionally strong so I'm not worried about an immediate decrypt happening, but obviously my latent misgivings about cloud vs convenience weren't strong enough to keep me from avoiding the cloud.

Never making that mistake again.

according to this page : 

https://support.msecure.com/en/support/solutions/articles/36000064305-msecure-s-security-model-secure-by-design

there's an additional 46 chr key that is never sent to their servers and that is stored locally on our devices so there's a master pw + a 46 chr key.

If all this is true and if I correctly understood the architecture also with a weak main password it shouldn't be that easy to decrypt a vault db.

Who agrees with what I wrote ? :) 

Unless there was a specific flaw that violated the principle of their design, they never should have had our passwords.  The app would have needed to have been compromised for that to happen, and while that's definitely possible, I don't think it's the most likely option.  People are imagining all the possible scenarios because we're not being told anything specific.  But the far more likely gap is that the vaults were stolen.

Yes exactly Corrado.  The info vacuum demands to be filled, and it's being filled with speculation.

On the plus side, Vaultwarden seems fun to tinker with.  Downside is having to train my spouse to use something new.

I submitted a message in here with links to what happened when basically the exact thing happened to LastPass in 2022. 
That was about 4 hours ago, so the message must have been rejected

@Corrado - thankyou I'd be keen to know.  I received their standard response to my ticket I raised.

@Ben, it might have been the included link, because I had the same thing happen to me.

I was pointing out that if a weak or re-used password had been used by the customer as their Master Password, the cretins responsible for the LastPass data theft were able to decrypt those individual vaults.

So if you A) used mSecure Cloud for your backups, and B) had a weak or re-used password as your Master Password, then you are at more risk than those who 1) used a complex password for their Master Password, or 2) did not use mSecure Cloud for their backups.  

That’s how I see it.

Kris, I agree with all you said, and came to exact same conclusion.
What my rejected message linked to was that LastPass paid out for a class action lawsuit and a UK fine. They are still in business.
If others are interested they can search for it.