mSecure password manager breach: what to reset first

mSeven Software, the company behind the mSecure password manager, has told current and former customers to change their passwords. The notice also says to reset two-factor authentication and remove existing passkeys. The trigger was "suspicious activity" connected to the app. A password manager holds the keys to everything else, so that's a lot of rotation. If your team used mSecure, even years ago, this applies to you.

What actually happened

BleepingComputer reported on November 4 that mSeven emailed customers on November 3:

• What mSeven said. It found suspicious activity tied to the mSecure app, started an investigation, took steps to contain it, and brought in external cybersecurity experts.
• What it told customers to do. Protect what's stored in the app. That may mean changing passwords, resetting or re-enrolling 2FA, and removing passkeys.
• Who it covers. Current and former customers.
• What it didn't say. Which systems were hit, whether data was stolen, or how many people are affected.

Customers shared support replies that, per BleepingComputer, say an attacker stole an encrypted database from mSecure Cloud. The replies say only users who synced with mSecure Cloud are affected and that mSeven has no evidence the encrypted data was accessed. That came from support staff, not the official notice, so treat it as reported, not confirmed. mSeven hadn't answered BleepingComputer's questions when the story ran.

Why the mSecure breach matters for your business

mSecure says vaults use AES-256 with zero-knowledge encryption. That protects you only as far as your master password does. A stolen encrypted vault can be attacked offline for as long as the attacker likes, and BleepingComputer compares it to the 2022 LastPass breach. A strong master password buys you time to rotate.

Here's the order we'd follow:

1. Email first. Whoever controls your email can reset almost everything else.
2. Banking, payroll, payment processors and your domain registrar.
3. Admin accounts: Google Workspace or Microsoft 365, your Shopify or hosting dashboard, DNS.
4. Reset 2FA anywhere TOTP seeds were stored in mSecure, then remove and re-create those passkeys.
5. Everything else, then decide whether to stay. A vendor that can't tell you what was taken is giving you information too.

If stored API keys were in the vault, rotate those too. Rotation is quick only when you've practiced it, as we covered in our leaked-key revocation post.

Sources: BleepingComputer.