Vatican's Official Prayer App Leaks 700K+ Global Users' PII
Vatican's official prayer app exposes 700K+ users' PII via insecure API endpoint.
The Vatican's official prayer application leaked personally identifiable information for over 700,000 global users through an unprotected API endpoint. The exposed data included names, email addresses, geographic location, and account status—all accessible to anyone with a web browser. The vulnerability represents a significant privacy breach affecting a large user base of religious application users worldwide.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Vatican?
Get an email when a new story names Vatican, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Vatican's official prayer app exposed personally identifiable information for over 700,000 users due to an API endpoint that required no authentication, meaning anyone with a browser could freely access sensitive data. This is a classic misconfigured API vulnerability — a growing attack surface as mobile and web applications increasingly rely on APIs to serve data. The exposed data (names, emails, location, account status) creates real risk for phishing, targeted scams, and religious profiling of users across the globe. The breach underscores that even mission-driven, non-commercial organizations must apply rigorous security controls to any internet-facing service handling personal data.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.