Password manager mSecure has warned current and former customers to protect the confidential information stored in its app after detecting “suspicious activity.”
But its advice about what users should do comes without an explanation of what happened or whose information might be at risk.
The warning leaves users to decide whether to replace credentials—and whether it’s safe to store replacements in mSecure.
While those are perfectly reasonable questions, mSecure’s warning does not answer them.
In an email published by The Hacker News and sent to customers on November 3, mSecure’s developer, mSeven Software, said:
“mSeven Software (‘mSeven’) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist.”
The notice recommends that customers “immediately take steps to protect all confidential information” stored in mSecure. Those steps:
“may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.”
But the notice does not identify the suspicious activity, when it occurred, which systems were involved, or whether anyone accessed customers’ stored information. The Register, which also reviewed the email, noted that the company had not explained whether customers’ secrets were exposed.
How to be safe
Because the scope of the incident is unknown, we recommend prioritizing your most important accounts while mSeven investigates.
Changing your mSecure password alone may not be enough if someone has already accessed your account. mSecure’s documentation explicitly warns that someone may already have made a backup of its contents. That guidance does not establish what happened in this incident.
Users should not have to wait for a completed forensic investigation before receiving useful guidance. They need to know who should act, which credentials need attention, and whether the tool they would normally use to manage those changes remains safe to use.
Until mSeven provides those answers, our advice is to prioritize your most important accounts, replace the relevant credentials through official services, and avoid destructive account resets:
- Change passwords through each service’s official website or app, beginning with your primary email, financial accounts, work accounts, and accounts used to recover access to other services. Use a new, different, strong password for each.
- Review two-factor authentication stored in the vault. If that could be compromised by unauthorized access, consider re-enrolling that account’s authenticator through the service’s security settings.
- For passkeys stored in mSecure, use each website or app’s account-security settings to remove the old registration and create a replacement with a different provider as a precaution. But make sure another working sign-in method is available first.
- Think carefully about where replacement credentials go. The notice does not establish whether saving new credentials in mSecure is safe. For users rotating important accounts now, using a different password manager temporarily is a reasonable precaution.
We’ll keep you posted if we learn more about this incident, so stay tuned.
Let’s face it, an incognito window can only do so much.
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.
