mSecure has told customers to change their passwords, reset two-factor authentication and consider removing their passkeys after the password manager's developer detected suspicious activity. In an email sent on November 3 and seen by The Register, US-based mSeven Software said it had launched an investigation, taken steps to mitigate the issue and engaged external cybersecurity experts, but it has not said what happened or whether anyone's stored secrets were exposed.
The email advises customers to take steps to protect all confidential information stored in the application. mSeven wrote: "Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application." It added: "This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."
According to The Register, mSeven has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information. Without that, customers have no way of telling which of their stored credentials actually need replacing.
The warning has gone down poorly on mSecure's support forum, where customers have demanded details. "Please provide more context to your email below advising there has been a security breach," one customer wrote. "It is not acceptable to offer the vague advice 'take steps'. Please state what remedial action is required, and what data was compromised." Another asked: "I have over 800 passwords in mSecure, is the email saying I need to change all of them!" A user, who said they had more than 500 passwords stored in the application, questioned whether the advice covered every two-factor authentication method and passkey linked to their accounts, or only those used to access mSecure itself. Customers have also shared copies of the notification on Reddit.
mSeven has yet to respond to The Register's questions. Its email concluded: "We regret any inconvenience that this may cause."
Analysis
Why This Matters
- A password manager holds the credentials for everything else a person uses, so a warning to reset stored logins can put hundreds of accounts in scope for a single user.
- Because the company has not said what the suspicious activity involved or when it happened, customers cannot tell which credentials are actually affected and have little choice but to treat everything stored in the app as needing replacement.
- The episode is a test of how a security product communicates during a possible incident: the advice is concrete, but the explanation behind it is not yet public.
Background
mSecure is a password management application developed by mSeven Software, a US-based company. Password managers are built to concentrate a user's logins behind one master password, which is what makes a warning of this kind consequential: a single alert can implicate every account a customer has saved. The advice in the November 3 email covers stored passwords, two-factor authentication enrolments and passkeys.
Key Perspectives
mSeven Software: says it recently learned of suspicious activity, launched an investigation, took steps to mitigate the issue and engaged external cybersecurity experts, and recommends users change passwords, reset or re-enrol two-factor authentication, or remove existing passkeys to protect all confidential information stored in the app.
mSecure customers on the support forum: want the company to state what happened and what data was compromised rather than give general advice to take steps, and are asking whether the guidance covers every stored credential, two-factor method and passkey or only those used to access mSecure itself.
What to Watch
- Whether mSeven says what the suspicious activity involved and when it occurred.
- Whether the company confirms or rules out access to customer information.
- Whether it clarifies the scope of the reset advice: every credential and authentication method a customer has stored, or only those protecting the mSecure account.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedmSecure told users to change passwords, reset two-factor authentication and consider removing passkeys after suspicious activity was detected.www.theregister.com - Articles: “Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity”
- SupportedThe Register reported that mSeven had not explained what the suspicious activity involved or whether customer information was accessed.www.theregister.com - Articles: “The company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information.”
- SupportedThe email was sent to customers on November 3 and seen by The Register.www.theregister.com - Articles: “In an email sent to customers on November 3, seen by The Register, US-based developer mSeven Software said it launched an investigation”
- SupportedmSeven said it learned of suspicious activity, launched an investigation, took steps to mitigate the issue and engaged external cybersecurity experts.www.theregister.com - Articles: “mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist.”
- SupportedmSeven wrote: “Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application.”www.theregister.com - Articles: “"Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email continued.”
- SupportedmSeven added: “This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.”www.theregister.com - Articles: “"This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."”
- SupportedThe Register said customers could not tell which credentials they needed to replace without knowing what happened.www.theregister.com - Articles: “And without knowing what happened, customers have no way of telling which credentials they actually need to replace.”
- SupportedA customer wrote: “Please provide more context to your email below advising there has been a security breach,” and “It is not acceptable to offer the vague advice ‘take steps’. Please state what remedial action is required, and what data was compromised.”www.theregister.com - Articles: “"Please provide more context to your email below advising there has been a security breach," one customer wrote. "It is not acceptable to offer the vague advice 'take steps'. Please state what remedial action is required, and what data was compromised."”
- SupportedAnother customer asked: “I have over 800 passwords in mSecure, is the email saying I need to change all of them!”www.theregister.com - Articles: “"I have over 800 passwords in mSecure, is the email saying I need to change all of them!" another customer asked.”
- SupportedA user who said they had more than 500 passwords stored questioned whether the advice applied to every two-factor method and passkey associated with their accounts or only those used to access mSecure.www.theregister.com - Articles: “A separate user, who said they had more than 500 passwords stored in the application, questioned whether the warning applied to every two-factor authentication method and passkey associated with their accounts, or just those used to access mSecure itself.”
- SupportedmSeven had yet to respond to The Register’s questions.www.theregister.com - Articles: “mSeven has yet to respond to The Register's questions”
- SupportedThe email concluded: “We regret any inconvenience that this may cause.”www.theregister.com - Articles: “The company's email concludes: "We regret any inconvenience that this may cause."”
