Even the Vatican Is Not Immune: Security Flaw Exposes Data of More Than 700,000 Users
- Author: Arno Schlösser, DP-Dock GmbH
- Last updated: August 2026
- Category: Data Security
A security vulnerability in the official Pope’s prayer app Click to Pray has exposed a rather modern problem for an institution more commonly associated with centuries-old traditions.
The vulnerability, discovered by a security researcher in January, potentially allowed unauthorized access to data belonging to more than 700,000 registered users. It is assumed that the affected information included names and email addresses, as well as profile pictures, dates of birth and countries of origin. Passwords, login credentials and personal prayer intentions were reportedly not affected.
The incident is particularly notable because Click to Pray is not an obscure experimental website. The service is operated by the Pope’s Worldwide Prayer Network and has been available internationally since 2016. Even or especially religious institutions, here arguably one of the biggest one in the world, have to ensure it’s accountability for storing and processing personal data on a very large scale.
When analyzing the whole case, there might be an underlying warning – Cybersecurity does not make exceptions for reputation, tradition or good intentions. A company, charity, government agency, school or religious institutions can all become targets or victims of data breaches and other cyberthreats. A familiar name or trusted institution does not automatically make the technology behind it secure.
For organizations, an important take-away here is that security should not be assumed simply because everything appears to be working. Systems need to be tested on a regular level, access controls reviewed, software maintained and vulnerabilities taken seriously when in doubt.
In an increasingly connected (digital) world, cybersecurity and its threats are to be taken seriously. Maybe companies should hold their breaths for a second and think – if even the Vatican can have a security gap in their technical applications, nobody should consider their own systems too small, too trusted or too important to fail.
