mSeven Software has notified current and former mSecure password manager users to take immediate protective steps after a cyberattack resulted in the theft of an encrypted customer database. The company sent a security notification to affected users on November 3, disclosing that suspicious activity had been detected involving its mSecure password management application.
In its notification, mSeven stated: "mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer."
The company recommended that all users take protective measures without initially providing specifics about what was compromised or how many customers were affected. mSeven advised users to "change passwords, reset or re-enroll two-factor authentication methods, or remove existing passkeys" to safeguard sensitive information.
mSecure functions as a password manager enabling users to store passwords, passkeys, financial information, and other sensitive data in encrypted vaults synchronized across multiple devices. According to mSeven's security documentation, the application employs AES-256 encryption and a zero-knowledge architecture that encrypts data locally on user devices before transmission to company servers, with the company claiming it cannot access decrypted vault contents.
The encryption protections have created confusion among users regarding why they should reset all stored passwords if their data was encrypted before reaching mSeven's servers.
Encrypted database theft confirmed to mSecure Cloud users
While mSeven's initial notification lacked detail, customer support interactions have revealed additional information about the incident. Users who contacted mSeven's support team received responses indicating that an attacker had stolen an encrypted database from mSecure Cloud containing information about both current and former users.
According to support responses shared by customers, mSeven stated: "Please note, this issue only pertains to users that were synching with the mSecure Cloud." The company also indicated it had discovered the theft, notified customers, and found no evidence that the attacker had accessed the confidential information within the encrypted database.
mSeven reportedly disclosed that it had deployed additional security measures and possessed no evidence suggesting the mSecure application was currently unsafe. Multiple customers reported receiving similar explanations confirming the incident was restricted to users who synchronized their password databases through mSecure Cloud.
Nevertheless, users have voiced dissatisfaction with mSeven's transparency regarding the breach and potential risks to stored credentials. The company has not publicly disclosed how the breach occurred, leaving customers uncertain about the full scope of the incident.
Even though mSeven claims no evidence of attackers accessing encrypted information, stolen password vaults can present substantial risks if attackers successfully crack weak master passwords through offline attacks. The 2022 LastPass breach demonstrated this vulnerability when attackers obtained backups containing encrypted password vaults. Researchers subsequently connected that breach to cryptocurrency thefts in which attackers are believed to have cracked weak master passwords to gain access to stored credentials, private keys, and recovery phrases.
mSeven Software has not responded to inquiries regarding the incident details, the stolen database, or the potential impact on customers.