# Vatican Prayer App Leaks 700K Users PII

> The Vatican's Click To Pray app exposed PII of 700K+ users through a misconfigured API endpoint requiring no authentication, showing even global organizations are vulnerable to basic security flaws.

**URL:** https://www.ciptadusa.com/blog/vatican-prayer-app-700k-pii-leak-20260727  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Application Security  
**Published:** 2026-07-27  
**Cover:** https://cdn-uagents.enitip.com/uploads/blog/2026-07/daily-appsec-20260727-014655.jpg  

## Article

Leaked data, discovered by security researchers in the Vatican's official prayer app, exposes personal information of more than 700,000 global users — including names, emails, locations, and spiritual preferences.

## Summary

The Vatican's Click To Pray app exposed PII of 700K+ users through a misconfigured API endpoint requiring no authentication, demonstrating that even global-scale organizations remain vulnerable to basic security failures.

## Background

Click To Pray is the Vatican's official mobile application for its global prayer community. With millions of downloads across iOS and Android, the app collects sensitive data: full names, email addresses, country, language, and — most critically — users' prayer preferences and spiritual intentions.

Security researchers discovered the app's backend API could be accessed without an authentication token. Endpoints that should have required session validation instead returned bulk user data through simple GET requests with pagination parameters.

This was not a sophisticated attack. This was a **basic misconfiguration** — an API endpoint left unprotected.

## The Challenge

This breach carries dimensions unusual compared to typical data leaks:

**Spiritual data as a sensitive category.** GDPR explicitly categorizes religious belief data as "special category data" requiring elevated protection. Prayer preferences and spiritual intentions are not merely PII — they reveal a person's deepest convictions. In many countries, this information could enable discrimination or persecution.

**Global scale, local governance.** The 700K+ affected users span dozens of countries with different regulations. The Vatican is not directly bound by GDPR, even though most of its users are EU citizens. This jurisdictional ambiguity complicates enforcement.

**Trust as an attack surface.** Users downloaded this app because they trust the institution behind it. That trust lowers vigilance — users are more willing to share sensitive data with an app associated with moral authority.

## Implications

This case reinforces a recurring pattern in application security: **organizations with non-technical missions often neglect basic security because they don't consider themselves "targets."** Hospitals, universities, NGOs, and religious institutions frequently maintain weaker security postures than small startups — despite collecting equally sensitive data.

For developers, the lesson is simple: every API endpoint returning user data must have authentication. No exceptions. Regardless of how "low-risk" the data appears from a business perspective. A pagination endpoint without auth is a vulnerability — not a feature.

## References

- [Vatican's Official Prayer App Leaks 700K+ Global Users' PII](https://www.darkreading.com/vulnerabilities-threats/vatican-official-prayer-app-leaks-700k-pii) — Dark Reading
- [GDPR Article 9 — Processing of Special Categories of Personal Data](https://gdpr-info.eu/art-9-gdpr/) — GDPR Info

---

*Markdown version of https://www.ciptadusa.com/blog/vatican-prayer-app-700k-pii-leak-20260727 — generated for AI agents and LLM crawlers.*