Password manager mSecure tells users to change passwords, won't say why

security

Customers left wondering what's been compromised after vendor advises resetting passwords, 2FA and passkeys

Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone's secrets were exposed.

In an email sent to customers on November 3, seen by The Register, US-based developer mSeven Software said it launched an investigation after discovering something amiss with its password management application.

"mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application," the company wrote. "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist."

The company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information. 

Its advice to customers, however, suggests that they should take this seriously.

"Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email continued. "This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."

For anyone with hundreds of passwords stored in mSecure, that's potentially hours of work. And without knowing what happened, customers have no way of telling which credentials they actually need to replace.

The warning has understandably gone down poorly with customers, who have taken to mSecure's support forum demanding answers.

"Please provide more context to your email below advising there has been a security breach," one customer wrote. "It is not acceptable to offer the vague advice 'take steps'. Please state what remedial action is required, and what data was compromised."

Others are wondering whether they're expected to spend the next several days changing every password they've ever saved.

"I have over 800 passwords in mSecure, is the email saying I need to change all of them!" another customer asked.

A separate user, who said they had more than 500 passwords stored in the application, questioned whether the warning applied to every two-factor authentication method and passkey associated with their accounts, or just those used to access mSecure itself.

The confusion has also spilled onto Reddit, where customers have shared copies of the vague notification and questioned what might have happened.

mSeven has yet to respond to The Register's questions, leaving customers to guess whether their data has actually been compromised or the company is simply being cautious. That's not exactly reassuring from a business whose entire purpose is keeping other people's secrets safe.

The company's email concludes: "We regret any inconvenience that this may cause." For customers contemplating hundreds of password resets, "inconvenience" may be putting it mildly. ®