Password manager mSecure tells users to change all credentials

Summarised from 2 outlets · Updated 4 Nov, 14:57 · Archive

Password manager mSecure has told users to reset passwords and authentication after a data breach.

Password manager mSecure confirmed a data breach on 3 November when parent company mSeven Software notified customers of suspicious activity. An unauthorised actor acquired an encrypted copy of a database containing information belonging to current and former users of the application.

The company advised users to "immediately" reset all passwords, two-factor authentication methods and passkeys stored within the manager. It engaged third-party cybersecurity experts to investigate the incident and mitigate the issue. However, the initial notification provided sparse details about what had been compromised or which users were affected.

Customers expressed frustration on social media at the lack of clarity. Some users questioned whether they needed to change only their master password or all credentials stored in mSecure—a task that could take hours for those with hundreds of saved passwords. One Reddit user called the notice "wildly insufficient", arguing that recommending potentially hundreds of credential changes without identifying the underlying threat or affected customers was inadequate. mSecure later issued a follow-up notice disclosing that an encrypted database copy had been obtained, though it characterised the breach as less severe than initially implied.

How it is being reported

• Top password manager mSecure tells users to change passwords immediatelyUsers synced with its cloud service might be at risk, as a copy of an encrypted database is nabbed.TechRadar · 4 Nov, 14:20
• Password manager mSecure tells users to change passwords, won't say whyCustomers left wondering what's been compromised after vendor advises resetting passwords, 2FA and passkeysThe Register · 3 Nov, 16:10

In this story: mSecure · mSeven Software

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem · Corrections log