Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint
Security researcher BobDaHacker published a detailed analysis of Click to Pray, the official application of the Pope's Worldwide Prayer Network, revealing a critical authorization flaw. At the time of discovery the service contained 719,517 registered accounts whose numeric IDs were fully sequential and predictable.
The vulnerable endpoint accepted direct requests such as GET https://api.clicktopray.org/user/users/12345 and returned complete profile information without verifying whether the requester was authorized to view the data. Changing the ID to 12346 immediately exposed another user record containing name, surname, email address, country, date of birth, role, and several internal fields. No rate limiting was implemented, allowing systematic enumeration of the entire user base.
The vulnerability is a classic example of Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA) in the OWASP API Security Top 10. Exploitation required no advanced techniques, only the ability to increment an integer. Additional minor issues included the misspelled field borned_date and the user role value PRAYER.
BobDaHacker first notified nine recipients in January 2026, including the general contact address, six service employees, and two representatives of the Pope's Worldwide Prayer Network. No replies or fixes followed. In July the researcher shared the findings with Dark Reading, whose journalists independently confirmed the exposure and attempted contact with both the network and the development agency La Machi. Again no responses were received.
Following public disclosure on 24 July the endpoint was modified the same day. Requests for other users’ IDs now return only public name and surname fields, while authenticated users can still view their own full records. The researcher learned of the fix through a Reddit comment rather than direct communication.
The incident echoes a 2019 security review of the related Click to Pray eRosary electronic rosary application. At that time researchers from Fidus Information Security found that four-digit PIN codes could be retrieved in plaintext via the sendPIN and resetPIN API calls, enabling immediate account takeover. Those specific issues were addressed after media coverage, yet the underlying pattern of missing authorization checks reappeared years later.
Related articles
Russian Medical Data Leaks Explode in July: 88 Million Records Exposed
In July 2026 more than 100 million records containing personal data of Russian citizens appeared in open access. Experts from Perspektivny Monitoring recorded 17 separate leaks originating from commercial organizations, online platforms, government bodies, e-commerce stores and medical institutions. The medical sector accounted for the overwhelming majority with 88.37 million records leaked, a sharp increase from 1.7 million in June. Two major incidents, one involving a large medical information system, drove the spike. Head of cyber threat research Nikolay Galkin stated that medical data has now leaked for four consecutive months and that attackers are deliberately targeting highly sensitive information. Other sectors also suffered losses, with 11.12 million records from commercial entities, 8.45 million from online platforms, 8.36 million from government organizations and 2.1 million from internet shops. Stolen databases are routinely traded in messenger channels and dark web marketplaces for use in fraud schemes.
SplitVPN Data Breach Exposes Personal Information of 865,000 Users
A data breach at the Russian VPN provider SplitVPN, formerly known as NotVPN, has exposed the personal details of approximately 865,000 users. The incident, which occurred in July 2026, involved a 17 GB SQL database containing emails, IP addresses, geolocation data, and partial payment card information. The stolen material was later distributed on a cybercrime forum, revealing 23.4 million user records, 13.6 million devices, and 2.6 million payment entries. Nearly 58 million connection logs spanning June 2025 to 21 July 2026 were also included, contradicting the company’s previous no-logs policy. The exposure is particularly concerning for users relying on the service to evade censorship and surveillance.
Measuring Data Leak Risk by Days of Silence Rather Than Megabytes in Cloud Environments
A financial expert turned security specialist argues that the true cost of data leaks in cloud offices stems not from the volume of exposed files but from the duration they remain undetected. The article details how routine actions such as making documents public, forwarding emails externally, or changing passwords can silently expose sensitive information in platforms like Yandex 360 without triggering any alerts. It warns against blanket prohibitions that push risky behavior into unmonitored channels like personal email or messengers, reducing visibility to zero. Instead, the recommended approach focuses on real-time event-driven notifications combined with automated remediation to minimize the window of exposure. The piece provides a detailed checklist for evaluating monitoring tools, including immediate reaction capabilities, self-healing actions, regular overview reports, and proof of system health. Emphasis is placed on secure integration via OAuth, data residency compliance, and the importance of treating employees as hurried professionals rather than malicious actors.
Russian Interior Ministry Opens Five Criminal Cases Against 'Glaz Boga' Analog Platforms Selling Personal Data of Russian Citizens
The Russian Ministry of Internal Affairs (MVD) has initiated five criminal investigations following the discovery of online platforms that sold personal data of Russian citizens, operating on the same model as the notorious 'Glaz Boga' service. These platforms allowed users to pay for access to detailed biographies and confidential information compiled into multiple files, including passport details, bank account records, and other sensitive personal information. The cases are being investigated under Article 272.1 of the Russian Criminal Code, which addresses the illegal use, transfer, collection, and storage of computer information containing personal data. Authorities have seized the servers of the implicated services and are currently analyzing their contents to gather evidence, although the specific names of the platforms, the number of clients, and the volume of data sold remain undisclosed. The developments highlight how repeated data leaks have transformed personal information into a marketable commodity traded on underground marketplaces, prompting law enforcement action against the operators responsible for distributing such data.