VULNpocalypse
MediumBreach / campaignOngoing

mSecure: mSeven warns customers to reset passwords after reported cyberattack

mSeven says it found suspicious activity tied to mSecure; current and former customers should change passwords, reset 2FA and remove passkeys.

Published
Exploitation
No, according to support replies shared by customers, mSeven says it has no evidence attackers accessed the encrypted vault contents

What happened

mSeven Software, the maker of the mSecure password manager, says it “recently learned of suspicious activity associated with the mSecure password management application.” That is according to a security notification sent to customers on November 3 and shared with BleepingComputer. mSeven says it launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts.

BleepingComputer reports that the notice did not say which systems were compromised, whether customer data was stolen, or how many users were impacted (BleepingComputer). The company still urged all current and former customers to protect the confidential information stored in the password manager.

Customers have shared support replies that they say came from mSeven. According to BleepingComputer, these replies say a hacker stole an encrypted database from mSecure Cloud that held information on current and former mSecure users. The replies also say the issue only affects users who were syncing with mSecure Cloud (BleepingComputer). The same replies reportedly say mSeven has no evidence the attacker accessed the confidential information inside the encrypted database. They also say the company has added security measures and has no evidence the app is currently unsafe to use.

BleepingComputer says mSeven’s security documentation describes AES-256 encryption and a zero-knowledge architecture, in which data is encrypted on users’ devices before it is sent to the company’s servers. BleepingComputer also notes that stolen encrypted vaults can still be at risk if weak master passwords are cracked offline. It points to the 2022 LastPass breach as an earlier case of this (BleepingComputer).

Not confirmed:

  • mSeven has not publicly confirmed the database theft. The detail comes from support replies that customers shared.
  • How the breach occurred.
  • How many users are affected.
  • Whether any vault contents were decrypted.

BleepingComputer says mSeven had not responded to its questions at the time of publication.

Am I affected?

  • mSeven’s notice went to all current and former mSecure customers (BleepingComputer).
  • According to support replies shared by customers, only users who synced their vaults with mSecure Cloud are affected. mSeven has not publicly confirmed this (BleepingComputer).
  • If you only stored your vault locally and never used mSecure Cloud, your exposure is not confirmed either way.

What to do now

  1. Change the passwords stored in your mSecure vault. This is the step mSeven recommends in its notice (BleepingComputer).
  2. Reset or re-enroll the two-factor authentication methods stored in or protected by the vault, as mSeven advises (BleepingComputer).
  3. Remove existing passkeys stored in mSecure, as mSeven advises (BleepingComputer).
  4. Prioritise high-value items such as financial information, crypto keys and recovery phrases. BleepingComputer notes that in the 2022 LastPass case, cracked vaults were linked to cryptocurrency theft (BleepingComputer).
  5. Watch for further statements from mSeven on scope and root cause, since these are not confirmed yet.

Sources