mSecure parol menejeri mijozlari hozirda unda saqlanadigan maxfiy ma'lumotlarni himoya qilish uchun zudlik bilan harakat qilishga chaqirilmoqda — ehtimol parollarni o'zgartirish, ikki omilli autentifikatsiyani (2FA) qayta o'rnatish va passkey'larni o'chirish orqali.
Ogohlantirish 3-noyabrda mSeven Software ishlab chiquvchisi nomidan yuborilgan elektron pochta xabarida keldi. Unda aytilishicha, kompaniya yaqinda ilova bilan bog'liq shubhali faollik haqida xabar topgan, lekin nima sodir bo'lgani yoki kimningdir saqlangan ma'lumotlari ochilganmi-yo'qmi, bu haqida hech narsa aytilmagan.
Elektron pochta xabarida aytilishicha, u hozirgi va sobiq mSecure mijozlariga yuborilgan. Uni olgan bir mijoz uning matnini 3-noyabrda mSecure'ning qo'llab-quvvatlash forumidagi mavzuda joylashtirgan.
3-noyabr soat 18:00 UTC holatiga ko'ra, mSeven mSecure'ning X va Facebook akkauntlarida elektron pochta haqida hech narsa e'lon qilmagan. O'sha forum mavzusida hech bir xodim javob bermagan.
Elektron pochta xabarida aytilishicha, mSeven tekshiruv boshlagan, muammoni cheklash uchun choralar ko'rgan va tashqi kiberxavfsizlik mutaxassislarini jalb qilgan. Unda ishtirok etgan tizimlar nomlanmagan, faollik qachon sodir bo'lgani yoki u to'xtaganmi-yo'qmi, shuningdek, xabarni olgan odamlar soni ham aytilmagan.
mSecure mijozning seyfini mSecure Cloud, Dropbox, iCloud yoki Wi-Fi orqali sinxronlashtirishi mumkin. Elektron pochta xabarida mijoz qaysi usuldan foydalanishi muhimmi-yo'qmi, bu haqida hech narsa aytilmagan.
mSecure 7 Essentials rejasi va undan yuqori rejalarida parollar yonida passkey'lar va 2FA kodlarini seyfda saqlashi mumkin. Elektron pochta xabaridagi tavsiya mSecure'da saqlanadigan ma'lumotlarni himoya qilish haqida. Xabarda 2FA va passkey qadamlarining seyfda saqlanadigan elementlarni, mSecure akkauntining o'z kirishini yoki ikkalasini ham qamrab olishi aytilmagan.
mSecure aytishicha, seyf ma'lumotlari mijozning qurilmasida shifrlanadi va keyin sinxronlashtiriladi, hatto uning ishlab chiquvchilari ham mijozlar ma'lumotlariga kirish imkoniga ega emas.
Android uchun mSecure 6.1.5 versiyasida mSeven nazariy jihatdan saqlangan ma'lumotlarga kirishi mumkin edi, Germaniyaning Axborot Xavfsizligi Federal Idorasi (BSI) ma'lumotiga ko'ra, bu 2025-yil dekabrda e'lon qilingan tadqiqotda aniqlangan. BSI faqat o'sha versiyani sinovdan o'tkazgan va uning natijalari keyingi yangilanishlar bilan o'zgargan bo'lishi mumkin.
Elektron pochta xabarida shubhali faollik seyf ma'lumotlariga yoki uni himoya qiluvchi kalitlarga yetib borganmi-yo'qmi, bu haqida hech narsa aytilmagan.
Elektron Pochta Mijozlardan Nima Qilishni So'raydi
Elektron pochta xabarida qadamlar ehtimol sifatida taklif qilingan va qaysi akkauntlar bilan birinchi navbatda shug'ullanish yoki har bir qadamni qanday bajarish haqida hech narsa aytilmagan. Shuningdek, mijozlar mSecure'dan foydalanishni davom ettirishlari kerakmi-yo'qmi, jumladan yangi parollarni saqlash uchun ham, bu haqida ham hech narsa aytilmagan.
3-noyabr soat 18:00 UTC holatiga ko'ra, Apple App Store'dagi mSecure'ning eng yangi iPhone versiyasi 7.1.0 bo'lib, u 23-oktabrda chiqarilgan.
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys.
The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but does not say what happened or whether anyone's stored data was exposed.
The email says it went to current and former mSecure customers. A customer who received it posted its text in a thread on mSecure's support forum on November 3.
As of 18:00 UTC on November 3, mSeven had posted nothing about the email on mSecure's X and Facebook accounts. No staff member had replied in that forum thread.
The email says mSeven started an investigation, took steps to limit the problem and brought in outside cybersecurity experts. It does not name the systems involved, say when the activity happened or whether it has stopped, or give the number of people who received the email.
mSecure can sync a customer's vault through mSecure Cloud, Dropbox, iCloud or Wi-Fi. The email does not say whether it matters which of these a customer uses.
mSecure 7 can keep passkeys and 2FA codes in the vault next to passwords, on its Essentials plan and above. The email's advice is about protecting information stored in mSecure. The email does not say whether the 2FA and passkey steps cover those stored items, the mSecure account's own sign-in, or both.
mSecure says vault data is encrypted on the customer's device before it is synced, and that even its developers cannot access customers' information.
In mSecure 6.1.5 for Android, mSeven could, in theory, access stored data, according to Germany's Federal Office for Information Security (BSI), which found this in a study published in December 2025. The BSI tested only that version, and its results may have changed with later updates.
The email does not say whether the suspicious activity reached vault data or the keys that protect it.
What the Email Asks Customers to Do
The email offers its steps as possibilities and does not say which accounts to deal with first or how to carry out each step. It also does not say whether customers should keep using mSecure, including to store their new passwords.
As of 18:00 UTC on November 3, the newest iPhone version of mSecure in Apple's App Store was 7.1.0, released on October 23.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.