We recommend password managers to every client, and we still do. They are the best practical way to give every account a long, unique password. But a password manager concentrates every secret in one place, so when one is breached, the right response is fast and thorough. This week's incident at mSecure is a useful rehearsal for every business that uses one.
What happened
The company's notice to customers was short. It said mSecure had "recently learned of suspicious activity," launched an investigation with outside cybersecurity experts, and recommended steps that "may include changing passwords, resetting or re-enrolling two-factor authentication methods… or removing existing passkeys." It has not answered press questions.
More detail came from the company's own support forum, where staff told customers that an attacker had taken an encrypted copy of a user database, that the issue only affects users who synced with mSecure Cloud, and that deleting the app would not change anything. They advised users to "change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys." The company has not published a formal statement saying this, so it rests on those support replies.
How the attacker got in, what fields the database contained and how many people are affected have not been disclosed.
Why "encrypted" is not the end of the story
A password manager's vault is encrypted with a key derived from the user's master password, and the company is not supposed to be able to read it. That design is why a stolen copy is not immediately a disaster. It is also why it is not harmless: an attacker with the encrypted copy can try to guess master passwords offline, as fast as their hardware allows, with no lockout and no alert.
How long that takes depends on two things: how strong the master password is, and how deliberately slow the product makes each guess. mSecure's own support staff wrote in 2022 that it did not use the standard technique for slowing down guesses, PBKDF2 hashing, relying instead on a random account key unlocked by the master password. Whether that has changed in the current version is not clear. Either way, a short or reused master password is the weak point.
This is the same pattern as the LastPass breach of 2022, when stolen encrypted vaults were later linked to cryptocurrency thefts thought to involve cracked weak master passwords. The damage there did not come the week of the breach. It came months and years later.
The advice to replace passkeys and reset two-factor authentication follows from what current versions of mSecure store. It keeps passkeys and one-time code secrets inside the vault alongside passwords. If a vault were ever decrypted, those would be exposed too.
What to do if you use mSecure
Change your master password first, to a long passphrase you have never used anywhere else. This protects future syncs, but not the copy already taken.
Then change the passwords that matter most, assuming the old vault could eventually be opened: email, banking, payroll, Microsoft 365 or Google admin accounts, and anything that could be used to reset other accounts.
Reset two-factor authentication for any account whose codes were generated by mSecure, and replace any passkeys stored in it. Moving them to a different authenticator is a reasonable choice.
Prioritize by damage, not by convenience. You do not need to change two hundred passwords tonight. Start with the ten accounts that would hurt most, and work down.
What every business should take from it
Master passwords are the real perimeter. Whatever product you use, insist on a long, unique master password for every staff member, and do not let anyone reuse it elsewhere.
Use a business plan with central control. Business editions of the major password managers let an administrator see who is enrolled, enforce master password rules, require two-factor authentication on the vault itself and remove access when people leave.
Keep the most critical recovery codes offline. Recovery codes for your main admin accounts can live in a sealed envelope in a safe rather than in the same vault as everything else.
Know your vendor's track record and design. Ask how vaults are encrypted, how master password guessing is slowed down, and how and how fast the vendor would tell you about a breach. A vendor that answers vaguely has told you something.
The summary
An attacker has an encrypted copy of mSecure's user database. Nothing suggests the vaults have been opened, but an encrypted vault is a problem that waits: its safety depends on the strength of each user's master password for as long as the attacker keeps the copy.
If you use mSecure, change your master password and your most important passwords now, and reset the two-factor methods it held. If you use any other password manager, keep using it, and make sure every master password in your business would survive the same test.
Sources
- Password manager mSecure tells users to change passwords, won't say why — The Register
- mSecure password manager hack prompts password reset warnings — BleepingComputer
- Customer discussion and support replies — mSecure support forum
- Passkeys and one-time passwords in mSecure 7 — mSecure
- Why choose mSecure — mSecure
