mSecure, a well-known password manager, has alerted its users to strengthen their account security following indications of unusual activity. This advisory, issued by mSeven Software, suggests users update their passwords, reset two-factor authentication (2FA), and evaluate the use of passkeys.
Security Alert for mSecure Customers
The notification was disseminated via email on November 3, although it did not specify the exact nature of the suspicious activity or confirm if any sensitive information was compromised. The communication targeted both current and former mSecure account holders, and one recipient shared the message on mSecure’s support forum on the same day.
Notably, as of 18:00 UTC on November 3, mSeven Software had not provided any updates on their social media platforms or responded to forum inquiries regarding the situation. The company has launched an investigation, engaged cybersecurity experts, and is working to mitigate the issue, though details remain scarce.
Investigation and Security Measures
The email from mSeven Software acknowledges steps being taken to address the problem but lacks specifics on the systems affected, the timeline of the incident, or the number of customers contacted. While mSecure offers synchronization through multiple platforms like mSecure Cloud, Dropbox, iCloud, and Wi-Fi, the advisory does not clarify if certain platforms are more vulnerable.
Users are encouraged to secure their information stored within mSecure, especially for those using the Essentials plan and above, which includes storing passwords, passkeys, and 2FA codes. However, the guidance did not specify whether the security recommendations pertain solely to data within the app or to the account’s login credentials as well.
Data Encryption and User Concerns
According to mSecure, all data within the vault is encrypted on the user’s device before synchronization, ensuring that even mSecure developers cannot access it. However, a past assessment by Germany’s Federal Office for Information Security (BSI) suggested potential access vulnerabilities in mSecure version 6.1.5 for Android, although these findings might not apply to later versions.
The advisory did not confirm whether the detected suspicious activity impacted vault data or its protective keys. Users are left to interpret the guidance, with no clear instructions on which steps to prioritize or whether to continue utilizing mSecure for securing new passwords.
At the time of the alert, the latest iPhone version of mSecure available on the App Store was 7.1.0, released on October 23. Users are advised to stay vigilant and follow best practices for securing their accounts.
