Vatican Prayer App Exposes Personal Data of 700K+ Users via Unprotected API
What Happened — An unauthenticated API endpoint in the Vatican’s official prayer mobile application returned user records containing names, email addresses, country, and site‑status fields. The data set, covering more than 700,000 global users, could be harvested by anyone with a web browser.
Why It Matters for Compliance & Audit Readiness
- The leak illustrates a failure to enforce SOC 2 CC6.2 – Privacy controls that require documented consent, data‑minimization, and protection of personally identifiable information.
- Continuous evidence of proper consent‑capture and DSAR (Data Subject Access Request) handling is essential to demonstrate GDPR/CCPA alignment during a SOC 2 audit.
- Verisq’s CookiePLUS privacy capability can provide the audit‑ready consent logs and DSAR workflow evidence needed to remediate this gap.
Who Is Affected – Religious‑service apps, faith‑based organizations, and any SaaS provider exposing user‑profile APIs.
Recommended Actions –
- Immediately secure the API (require authentication, rate‑limit, and input validation).
- Conduct a privacy impact assessment (PIA) to map data flows against GDPR/CCPA obligations.
- Deploy a consent‑management solution that logs user opt‑ins/opt‑outs and supports DSAR fulfillment.
- Capture the remediation steps as evidence for SOC 2 CC6.2 compliance.
Source: Dark Reading
Technical Notes – The exposure stemmed from a misconfigured public API endpoint; no CVE was cited. The data types leaked were PII (name, email, country) and account‑status metadata.