A password manager is still one of the best tools a small business can use. That is why it is worth paying attention when one of them reports a problem.
On 3 November, mSeven Software, the company behind the mSecure password manager, emailed customers about “suspicious activity” linked to its app. TechRadar reports the company confirmed a breach involving an encrypted cloud database holding data from current and former users. Out of an abundance of caution, it told customers to change their important passwords, MFA methods and passkeys. It also said there was no evidence that vaults had been decrypted.
The disclosure has drawn criticism. Malwarebytes points out that the warning did not explain what happened or whose information might be at risk. That leaves users to decide for themselves whether to change everything, and whether to keep storing the new passwords in mSecure.
If your business uses mSecure
Do not try to change hundreds of passwords in one afternoon. Work in order of damage:
- Email first. Whoever controls your email can reset almost everything else.
- Then money. Online banking, payment platforms, accounting software and payroll.
- Then admin accounts. Microsoft 365 or Google admin, your website, domain and hosting.
- Reset MFA on those accounts too. mSecure’s advice covered MFA methods as well, and many password managers can also hold MFA codes.
- Former users count. If a staff member used mSecure in the past, their old data may be included.
If you use a different password manager
This is not a reason to go back to spreadsheets or reused passwords. It is a good reminder to check three things: that your important accounts have MFA, that you know which staff use which password manager, and that you have a written plan for the day any supplier tells you to reset everything.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.