SoylentNews

day of the dalek [soylentnews.org] writes:

This morning, mSecure sent an ominous email notification to their customers. I received the email, and here is the full text of the message:

mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

We regret any inconvenience that this may cause.

Sincerely,
The mSeven Software Team

For those unfamiliar with mSecure, they produce a password manager application for various systems including mobile devices that run Android and iOS. I use mSecure's password manager for Android. Their email is as vague as it gets and provides zero details about what the "suspicious activity" entails, what data might have been compromised, who is actually affected, and if confidential data might have already been abused. Because mSecure produces software for multiple systems, it's not clear if this just affects some systems, or what functionality might have compromised users' data. This reads like a statement written by a lawyer to minimize risk instead of a good faith disclosure of a security incident. As you might imagine, users are very displeased with mSecure's vendor and the lack of transparency. An article in The Register [theregister.com] describes the backlash against mSecure over the notice:

The company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information.

Its advice to customers, however, suggests that they should take this seriously.

For anyone with hundreds of passwords stored in mSecure, [changing all of the passwords is] potentially hours of work. And without knowing what happened, customers have no way of telling which credentials they actually need to replace.

The warning has understandably gone down poorly with customers, who have taken to mSecure's support forum demanding answers.

"Please provide more context to your email below advising there has been a security breach," one customer wrote. "It is not acceptable to offer the vague advice 'take steps'. Please state what remedial action is required, and what data was compromised."

Others are wondering whether they're expected to spend the next several days changing every password they've ever saved.

"I have over 800 passwords in mSecure, is the email saying I need to change all of them!" another customer asked.

mSeven has yet to respond to The Register's questions, leaving customers to guess whether their data has actually been compromised or the company is simply being cautious. That's not exactly reassuring from a business whose entire purpose is keeping other people's secrets safe.

Since the email specifically references their password manager application, I am theorizing someone introduced malicious code to decrypt and exfiltrate confidential data that users stored. But the email is so vague that it's impossible to make that determination. The notice seems like it was crafted by a lawyer to give the illusion of good faith while minimizing liability if compromised data is misused. But failing to disclose adequate details about the "suspicious activity" is actually spectacularly bad faith, and mSecure's users have noticed. Personally, I have sent an email to mSecure support requesting additional information but stating that I'll file a consumer complaint with my state's Attorney General if I get another vague message or if I don't receive a reply at all. If there's a problem that may have compromised my private data, that's extremely annoying. But it's a much bigger problem when businesses aren't honest and forthcoming when users' data is potentially compromised.

Original Submission