mSeven Software, mSecure parol menejeri ishlab chiqaruvchisi, mijozlarga "shubhali faoliyat"ni aniqlagandan so'ng ilovada saqlangan barcha maxfiy ma'lumotlarni himoya qilishni tavsiya qildi. Xabarda texnik tafsilotlar juda kam berilgan.
Elektron pochta 2026-yil 3-noyabr sanasi bilan belgilangan. Unda mSeven "yaqinda mSecure parol boshqaruv ilovasi bilan bog'liq shubhali faoliyat haqida ma'lumot olgan" deb aytilgan.
Kompaniya tekshiruv boshlaganini, muammoni yumshatish choralarini ko'rganini va tashqi kiberxavfsizlik mutaxassislarini jalb qilganini aytadi. Xabar oluvchilar hozirgi yoki sobiq mijozlardir.
Kompaniya foydalanuvchilarga ma'lumotlarini himoya qilish uchun "darhol choralar ko'rish"ni tavsiya qiladi. Bu choralar "parollarni o'zgartirish, ikki omilli autentifikatsiya usullarini qayta o'rnatish yoki qayta ro'yxatdan o'tkazish, yoki mavjud passkey'larni o'chirish"ni o'z ichiga olishi mumkin. Xabarda nima kirilganligi, faoliyat qachon boshlanganligi yoki u to'xtatilganligi aytilmagan, deb mSecure qo'llab-quvvatlash forumi mavzusida qayd etilgan.
mSecure qo'llab-quvvatlash forumi elektron pochta yuborilganidan bir necha soat ichida shikoyatlar bilan to'ldi. Foydalanuvchilar tavsiyani harakat qilish uchun juda noaniq deb atashdi, ba'zilari esa yuzlab saqlangan yozuvlarga ega ekanliklarini aytishdi.
Bir mijoz o'zi bilgan boshqa mSecure foydalanuvchilari elektron pochtani olmaganini va bu fishing bo'lishi mumkinligini aytdi. Xabar kompaniyaning o'z qo'llab-quvvatlash forumidan tashqari mustaqil tasdiqlanmagan, shuning uchun foydalanuvchilar elektron pochtadagi havolalarga bosmasliklari va to'g'ridan-to'g'ri rasmiy saytga kirishlari kerak. Shunga o'xshash soxta LastPass xakerlik elektron pochtalari allaqachon zararli dasturlarni tarqatish uchun ishlatilgan, shuning uchun taqlid qilish haqiqiy xavotir.
Forum muhokamasida asosiy tafsilotlar hali ham yo'qligi ko'rsatilgan. Bular qaysi tizimlar ta'sirlanganligi, shifrlangan omborlarga kirilgan yoki o'g'irlanganligi, va hisob kalitlari yoki autentifikatsiya QR kodlari kabi kalit materiallari ochilganligi yoki yo'qligini o'z ichiga oladi. Shuningdek, nol-bilim dizayni hali ham amal qiladimi yoki yo'qligi noaniq.
Foydalanuvchilarga Barcha Saqlangan Parollarni O'zgartirishni Tavsiya Qiladi
mSecure ombor ma'lumotlari sinxronlashdan oldin mahalliy shifrlanishini va mSeven shifrlangan ma'lumotlarni o'qiy olmasligini aytadi. Agar bu dizayn amal qilgan bo'lsa, server tomonidagi shifrlangan ma'lumotlarga hujum avtomatik ravishda ochiq matnni ochib bermaydi. Barcha parollarni qayta o'rnatish tavsiyasi mSeven yoki ta'sirni inkor eta olmasligini yoki ehtiyotkorlik bilan harakat qilayotganini ko'rsatadi.
Bir foydalanuvchi hisob parolini o'zgartirish QR kod va kalitni aylantirganini xabar qildi. U eski kalitlar bilan birga omborlarni o'g'irlagan hujumchilar ularni oflayn tarzda shifrlashlari mumkinligi haqida ogohlantirdi. Bu foydalanuvchi guvohligi, sotuvchi ko'rsatmasi emas. Ba'zi foydalanuvchilar mSecure'ning 6-versiyadan boshlab majburiy markazlashtirilgan bulut sinxronlashiga o'tishini ham tanqid qilishdi.
2022-yildagi LastPass buzilishi xavfni ko'rsatadi. Hujumchilar shifrlangan omborlarni yuklab olishdi, zaif asosiy parollarni oflayn tarzda sindirishdi va o'g'irlangan ma'lumotlardan yillar davomida foydalanishda davom etishdi.
mSeven tafsilotlarni e'lon qilmaguncha, foydalanuvchilar mSecure hisob parolini o'zgartirishlari va shifrlash kaliti aylanishini tasdiqlashlari kerak. Ular elektron pochta, bank, bulut va kripto kabi yuqori qiymatli hisoblarni ustuvor qilishlari kerak.
Shuningdek, ular muhim xizmatlarda MFA'ni qayta ro'yxatdan o'tkazishlari, eng yaxshi ko'p omilli autentifikatsiya provayderlaridan birini ishlatishlari va sotuvchi tavsiya qilganidek, ro'yxatdan o'tgan passkey'larni ko'rib chiqishlari kerak. Foydalanuvchilar elektron pochtadagi havolalarga e'tibor bermasliklari va xabarni nusxalovchi fishingdan ehtiyot bo'lishlari kerak.
SOC'ingizga tezkor hodisalarni to'xtatish uchun ogohlantirish kontekstini bering. 16K SOC'dan tahdid razvedkasini integratsiya qiling.
mSeven Software, the developer of the mSecure password manager, has advised customers to secure all confidential data stored in the app after detecting “suspicious activity.” The notice provides minimal technical details.
The email is dated November 3, 2026. It says mSeven “recently learned of suspicious activity associated with the mSecure password management application.”
The company says it launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts. Recipients are current or former customers.
The company recommends that users “immediately take steps” to protect their data. These steps “may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.” The notice does not say what was accessed, when the activity began, or whether it has been contained, according to the mSecure support forum thread.
The mSecure support forum was filled with complaints within hours of the email. Users called the advice too vague to act on, and some said they hold hundreds of stored records.
One customer reported that other mSecure users he knows had not received the email and wondered whether it was phishing. The notice has not been independently confirmed beyond the company’s own support forum, so users should avoid clicking links in the email and go directly to the official site. Similar fake LastPass hack emails have already been used to spread malware, so impersonation is a real concern.
The forum discussion shows that key details are still missing. These include which systems were affected, whether encrypted vaults were accessed or exfiltrated, and whether key material such as Account Keys or authentication QR codes was exposed. It is also unclear whether the zero-knowledge design still holds.
Urges Users to Change All Stored Passwords
mSecure says vault data is encrypted locally before it syncs and that mSeven cannot read decrypted data. If that design held, an attack on server-side encrypted data would not automatically expose plaintext. The blanket reset advice suggests that mSeven either cannot rule out exposure or is being cautious.
One user reported that changing the account password rotated the QR code and key. He warned that attackers who stole vaults along with the old keys could still decrypt them offline. This is user testimony, not vendor guidance. Some users also criticized mSecure’s move to mandatory centralized cloud sync since version 6.
The 2022 LastPass breach shows the risk. Attackers downloaded encrypted vaults, cracked weaker master passwords offline, and kept using the stolen data for years.
Until mSeven publishes details, users should change the mSecure account password and confirm that the encryption key rotates. They should prioritize high-value accounts such as email, banking, cloud and crypto.
They should also re-enroll MFA on critical services, using one of the best multi-factor authentication providers, and review registered passkeys, as the vendor advises. Users should ignore links in emails and watch for phishing that copies the notice.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.