mSecure told current and former customers to change passwords after a hacker reportedly stole an encrypted customer database. A weak master password is the risk.
mSeven Software, the maker of the mSecure password manager, emailed current and former customers on November 3 with a warning. It said to change passwords, reset two-factor authentication and remove passkeys after a cyberattack. A hacker reportedly stole an encrypted customer database from mSecure Cloud, the company's syncing service.
The email was short. It said mSeven recently learned of suspicious activity, started an investigation and hired outside security experts. It did not say which systems were hit, whether customer data was stolen or how many people are affected.
More detail came from customers who shared replies from mSeven's support team. Those replies reportedly say the stolen database held information belonging to current and former users. They also say the company has no evidence the attacker accessed the confidential information inside it.
mSecure stores passwords, passkeys and financial details in encrypted vaults. Passkeys are a newer way to sign in without typing a password. The company says data is locked on your own device before it is sent to its servers, so it cannot read your vault. Many customers wonder why they must change everything if that is true.
The answer is the master password, the one password that unlocks your vault. A thief with a stolen copy can try endless guesses on their own computers, with no one to stop them. A weak master password could fall. This happened after the 2022 LastPass breach, when attackers stole encrypted vault backups. Researchers later linked it to cryptocurrency thefts, in which attackers are believed to have cracked weak master passwords.
mSeven reportedly says the problem only affects people who synced through mSecure Cloud. It also says it has added security measures and has no evidence the app is unsafe to use today. If your vault stayed on one device and never synced, that points to lower risk. Still, the company sent its warning to all current and former customers, so treat it seriously.
The steps are in the alert box above. Start with your master password, then your email and banking accounts. Be wary of any message about the breach, since scammers like to copy real warnings.
mSeven has not publicly explained how the breach happened. Customers have said they are frustrated by the lack of detail. BleepingComputer asked the company about the stolen database and the impact on customers and had not received a response at the time of its report.
If you use or ever used mSecure, change your master password to a long, unique one today, then update your key accounts.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesEA has re-released 25 classic PC games at a discount until November 19, and Bethesda has finally given The Elder Scrolls VI a subtitle: Sentinel.
Read more: EA brings 25 classic PC games back, and Elder Scrolls VI gets a nameThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
