A popular prayer app connected to the Vatican, “Click to Pray,” has been leaving user information exposed for months, the most recent in a years-long string of vulnerabilities and hacks for Vatican-related websites.
The app, which is available on both iOS and Android, suffers from an insecure direct object reference (IDOR) vulnerability, cybersecurity news site Dark Reading reported Friday.
As a result, names and email addresses for more than 700,000 users are easily available to any web user, the site said.
The app, which is used by hundreds of thousands of people around the world, is run by the Pope’s Worldwide Prayer Network, which is a pontifical society entrusted to the Society of Jesus, tasked with “supporting the Holy Father’s evangelizing mission through prayer for a mission of compassion for the world.” It offers daily prayer prompts and opportunities to share prayer intentions with other users.
The site reported that the vulnerability was first noted in January by a hacker who goes by “BobDaHacker” on his blog. BobDaHacker and Dark Reading both reported reaching out to officials at the app and the group that runs it, but said they received no response.
The Vatican’s own website has been targeted repeatedly by hackers in recent years, sometimes connected to political issues.
The group Anonymous took the Vatican website offline briefly in 2012 and 2015, criticizing the Catholic Church’s doctrine and what it called “absurd and anachronistic concepts.”
Another suspected hacking incident took the site down in 2022, after Pope Francis criticized Russia’s invasion of Ukraine. It was unclear who was responsible for the incident.
In 2020, a report by threat intelligence firm Recorded Future argued that China had been working to hack into Vatican systems ahead of the renewal of the Vatican-China deal on bishop appointments.
Andrew Jenkinson, group CEO of Cybersec Innovation Partners, said he repeatedly contacted the Vatican in 2020 to highlight inadequacies in the Vatican’s cybersecurity system and to offer to help fix the weaknesses
The Vatican’s website crashed again in 2024, with experts saying the incident bore the hallmarks of a cyberattack.
It may help people contextualize this news to know that the Pope’s Worldwide Prayer Network is the society formerly (and sometimes still) known as the Apostleship of Prayer and entrusted to the Jesuits. Pope Francis established the PWPN as a pontifical foundation in 2020 and new statutes were promulgated in 2024.
https://www.vatican.va/content/francesco/en/motu_proprio/documents/20240701-statuto-rete-mondiale-preghiera.html
Good thing I never downloaded the app! Hopefully Montse can bring in some better cybersecurity people when she gets there. November can't come soon enough!!