mSeven Software is urging current and former mSecure password manager customers to change their passwords, reset or re-enroll their two-factor authentication, and remove existing passkeys after hackers allegedly stole an encrypted customer database. The company has not disclosed how the incident occurred, how many users were affected, or whether attackers accessed the sensitive information stored in the database.
In a security notice sent to customers on November 3 and shared with BleepingComputer, mSeven said it had discovered suspicious activity involving the mSecure password management application.
“mSeven Software (‘mSeven’) recently became aware of suspicious activity related to the mSecure password management application,” the notice said.
“In response, mSeven immediately began an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. Those who received this email are current or former mSecure customers.”
The notice did not identify the compromised systems, confirm whether customer data had been stolen, or state how many people were affected. However, it advised all current and former customers to take steps to protect information stored in their password manager.
“This may include changing your password, resetting or re-enrolling your two-factor authentication method, or removing your existing passkey,” the security notice said.
mSecure allows users to store passwords, passkeys, financial information, and other sensitive data in an encrypted vault that can be synchronized across devices.
According to mSeven’s security documentation, mSecure uses AES-256 encryption and a zero-knowledge architecture. Data is encrypted locally on users’ devices before being sent to the company’s servers, and mSeven says it cannot access the contents of customers’ decrypted vaults.
Those protections have led customers to question why they are being advised to change stored passwords and authentication methods if their data was encrypted before being uploaded to the company’s servers.
Encrypted mSecure database reportedly stolen
Although the initial notification provided few details, one customer reportedly shared a response from mSeven’s support team saying that an attacker had stolen an encrypted database from mSecure Cloud.
In a support forum post, a customer shared a response stating that the stolen database contained information belonging to current and former mSecure users. According to the response, mSeven discovered the theft and subsequently notified customers.
The response also said the company had no evidence that attackers accessed sensitive information stored in the encrypted database.
“Please note that this issue only pertains to users who were syncing with mSecure Cloud,” the response said.
mSeven reportedly told customers that it had implemented additional security measures and that there was no evidence the mSecure application was unsafe to use at that time.
Other customers reported receiving a similar explanation, including confirmation that the incident was limited to users who synchronized their password databases through mSecure Cloud.
Why a stolen encrypted vault can still pose a risk
Customers have expressed frustration about mSeven’s limited disclosure of the incident and the potential risk to their credentials. The company has not publicly explained how the database was stolen or how the attackers obtained access.
Even if mSeven has no evidence that attackers accessed the encrypted contents, a stolen password vault could still create a significant risk if its master password is weak enough to be cracked through an offline attack.
A similar concern arose after the 2022 LastPass breach, in which attackers stole backups containing encrypted password vaults. Researchers later linked that incident to cryptocurrency theft, saying attackers apparently cracked weak master passwords and accessed stored credentials, private keys, and recovery phrases.
BleepingComputer contacted mSeven Software with questions about the incident, the database theft, and its potential impact on customers, but had not received a response at the time of publication.
Source: www.bleepingcomputer.com