Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint
Security researcher BobDaHacker published a detailed analysis of Click to Pray, the official application of the Pope's Worldwide Prayer Network, revealing a critical authorization flaw. At the time of discovery the service contained 719,517 registered accounts whose numeric IDs were fully sequential and predictable.
The vulnerable endpoint accepted direct requests such as GET https://api.clicktopray.org/user/users/12345 and returned complete profile information without verifying whether the requester was authorized to view the data. Changing the ID to 12346 immediately exposed another user record containing name, surname, email address, country, date of birth, role, and several internal fields. No rate limiting was implemented, allowing systematic enumeration of the entire user base.
The vulnerability is a classic example of Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA) in the OWASP API Security Top 10. Exploitation required no advanced techniques, only the ability to increment an integer. Additional minor issues included the misspelled field borned_date and the user role value PRAYER.
BobDaHacker first notified nine recipients in January 2026, including the general contact address, six service employees, and two representatives of the Pope's Worldwide Prayer Network. No replies or fixes followed. In July the researcher shared the findings with Dark Reading, whose journalists independently confirmed the exposure and attempted contact with both the network and the development agency La Machi. Again no responses were received.
Following public disclosure on 24 July the endpoint was modified the same day. Requests for other users’ IDs now return only public name and surname fields, while authenticated users can still view their own full records. The researcher learned of the fix through a Reddit comment rather than direct communication.
The incident echoes a 2019 security review of the related Click to Pray eRosary electronic rosary application. At that time researchers from Fidus Information Security found that four-digit PIN codes could be retrieved in plaintext via the sendPIN and resetPIN API calls, enabling immediate account takeover. Those specific issues were addressed after media coverage, yet the underlying pattern of missing authorization checks reappeared years later.
Related articles
Moscow Court Places Dodo Pizza Cyberattack Suspect Denis Fridman Under House Arrest Until 2026
The Tverskoy District Court of Moscow has ordered Denis Fridman to remain under house arrest until December 8, 2026, in connection with a cyberattack on Dodo Pizza that occurred in late September. Fridman faces charges under paragraphs a and v of part 3 of Article 272.1 of the Russian Criminal Code, which covers the illegal circulation of computer information containing personal data. Investigators detained three of the four suspects after Fridman failed to mask his real IP address while accessing the stolen dataset. The breach lasted two days, but Dodo Pizza quickly blocked access and confirmed that payment details were not compromised because the company does not store them. Authorities notified Roskomnadzor of the incident and implemented measures to forcibly terminate active user sessions where necessary. House arrest remains a preventive measure, and Fridman’s guilt has not yet been established by the court.
Yandex Disk Data Center Incidents Leave Photos and Videos Inaccessible, Custom Recovery Tool Emerges
Following incidents at Yandex data centers in Sasovo and Vladimir, large numbers of photos and videos stored on Yandex Disk became unavailable for normal download. The company attributed the restrictions to load reduction, yet analysis indicates permanent loss of certain data clusters with no confirmed backups. Photos remain partially recoverable through lower-resolution S3 copies such as XXXL and XXL, while videos suffer from missing byte ranges that produce truncated or corrupted files. A researcher developed a specialized tool using mitmproxy to intercept browser requests and download available file variants in parallel streams. The utility also attempts block-by-block video retrieval to salvage whatever segments remain accessible. Users are warned that continued use of the tool may violate service terms and risk account suspension. The developer advises downloading data immediately rather than waiting for potential further degradation.
AT&T to Pay $177 Million to Settle Two 2024 Customer Data Breach Class Actions
AT&T has agreed to pay a total of $177 million to resolve two separate class-action lawsuits stemming from major customer data leaks that occurred in 2024. The settlement, approved on October 2 by Judge Sidney Fitzwater in the Northern District of Texas, allocates $149 million to the first breach and $28 million to the second, covering compensation, attorney fees, and administrative costs. The first incident, disclosed on March 30, 2024, exposed personal information of 73 million individuals, including names, addresses, phone numbers, dates of birth, account passwords, billing numbers, and Social Security numbers for some victims, with records dating from 2019 or earlier found on the dark web. The second breach originated from unauthorized access to AT&T’s Snowflake cloud environment between April 14 and 25, 2024, affecting nearly all mobile customers and revealing call metadata such as phone numbers, interaction counts, durations, and cell tower identifiers from May to October 2022 plus January 2023. No evidence of direct system intrusion was found in the first case, and the second exposure did not include Social Security numbers or call content. Individual claimants can receive up to $5,000 or $2,500 respectively for documented losses, with the claims deadline set for December 18, 2025. AT&T settled without admitting any wrongdoing or liability.
EY Confirms Data Breach Exposing Goldman Sachs and Man Group Client Details via Checkmarx Vulnerability
EY has confirmed a data breach involving client documents accessed through a third-party technology services management platform used to support its tax operations. The unauthorized access occurred via a vulnerability in Checkmarx software and lasted from March 28 to April 12, with detection only on April 23. Exposed information included names, addresses, tax identification numbers, email addresses, and financial details belonging to clients in Goldman Sachs wealth management and the Man Group investment fund. Neither Goldman Sachs nor Man Group systems were compromised, confirming the exposure originated solely from EY's environment. The leaked materials consisted of attachments from support tickets rather than core system data. EY has engaged independent security firms, notified regulators in California, Texas, Massachusetts, and Vermont, and offered credit monitoring to affected individuals.