Password manager mSecure tells users to change passwords and remove passkeys, without saying what happened
mSecure's developer emailed current and former customers on November 3 about suspicious activity linked to the password manager, advising them to change passwords, reset two-factor authentication and possibly remove passkeys. It has not said what happened or whether vault data was exposed.
mSeven Software, the developer of the mSecure password manager, emailed current and former customers on November 3 saying it had learned of suspicious activity linked to the app, opened an investigation and brought in outside experts. "mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email said, adding that this "may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys." The email, seen by The Register and posted by a customer on mSecure's support forum, does not say what happened, when, which systems were involved, or whether any vault data was exposed. mSecure 7 can store passkeys and two-factor codes alongside passwords, and the company says vaults are encrypted on the device before they sync.
Why it matters
A breach notice with no scope forces the worst-case response: rotate everything in the vault. The advice reaching passkeys and two-factor methods shows the cost of keeping every factor in one place, because a vault holding both a password and its TOTP seed is no longer two factors. From the email alone, nobody can tell whether the advice is a precaution or reflects exposed data.
If you use mSecure, start with the accounts that reset others: email, your identity provider, banking and cloud consoles. Move the TOTP seeds for those to a separate authenticator, and where a service supports passkeys bound to your own device, use them; our MFA matrix shows which business apps support them. Our password manager entry covers what a vault does and does not protect.
Source: The Register
Related on Start with Identity
- BlogDreamHost says File Manager attacker took FTP passwords and webmail sessions for about ten weeks
DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of ev
- BlogChainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached producti
- BlogSony's So-net says an intruder took 2.6 million member records and 54,401 email passwords
Sony Network Communications said on October 27 that an outsider reached the So-net member database on October 19 and took about 2.6 million So-net and plala rec
- RecipeMigrate users from Auth0 to another CIAM without forcing password resets
Export Auth0 users with the Management API, request the bcrypt password hashes through an Auth0 support ticket (not on the Free plan), then import the hashes in
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- PodcastOkta
Okta's 2023 interview series for product managers and marketers on using customer identity to build better experiences. One season, 14 episodes.