Overview
- mSeven disclosed on November 3 that an unauthorized actor acquired an encrypted copy of a database containing information from current and former users who synced with mSecure Cloud.
- The company told affected users to immediately change master and stored passwords, reset or re-enroll two-factor methods, and remove passkeys, and it said deleting the app will not address the issue.
- mSeven says vaults are encrypted on customers’ devices and that it has no evidence the attacker decrypted stored secrets, but the stolen encrypted dataset could still be hoarded for future decryption.
- Customers and forum users criticized the company’s initial notice for offering few technical details and creating the heavy operational burden of rotating potentially hundreds of credentials.
- mSeven says it has begun mitigation, launched a formal investigation and engaged outside cybersecurity experts, yet key questions remain about which sync methods and whether encryption keys or vault data were accessed.