The Family Federation for World Peace and Unification (FFWPU) and its Tongil Group affiliates are alleged to have been breached, with a dark web post offering extensive internal databases and personal records for sale. The seller claims the data was exfiltrated between January and March 2026 via an IDOR vulnerability and...

There was a security flaw in the Vatican's official Click to Pray application that exposed personal information linked to more than 700,000 registered users, but the vulnerability remained unknown until it was detected by an independent security researcher earlier this year.  A worldwide prayer network developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer Network, Click to Pray was launched in 2019 with the endorsement of Pope Francis. Through this service, three daily prayers are delivered as well as papal content on Android, iOS and the web as part of a digital prayer platform.  Independent researcher BobDaHacker discovered in January that API endpoints could provide information about users beyond the accounts associated with their requests. The underlying user IDs were sequentially assigned, making accessing records belonging to other registered accounts possible.  Researchers identified 719,517 registered user IDs within the affected system, which indicates how much information is contained within that system. The vulnerability was addressed by the application developers earlier this year. There was a separate vulnerability in the Click to Pray API that also affected the verification process of email addresses.  The vulnerability is not limited to user details. This API provided the validation hash that was used to verify an account's email address, which enabled attackers to potentially verify an account's email address without accessing the inbox itself. As a result of these weaknesses, multiple points of vulnerability were identified within the application's account system, in addition to the IDOR vulnerability.  Researchers reported the vulnerability to the Pope's Worldwide Prayer Network and Click to Pray on January 3, 2026; however, no response has been received. Multiple attempts to contact relevant contacts have been made, but no response has been received. Over six months later, the issue was finally addressed after the researcher contacted a journalist, who brought the matter to the attention of the Vatican.  A number of security issues have also occurred regarding Vatican-related applications in the past. According to reports, a vulnerability in the Vatican’s Bluetooth eRosary application has exposed account verification PINs in web responses, creating a potential route for account theft. In the latest incident, insufficient access controls highlight the risks associated with applications handling personal information.  Although the Click to Pray vulnerability was reported to have been addressed, the episode raises broader concerns regarding security testing, vulnerability reporting processes and the protection of personal data within religious and public-facing digital services. The user information exposed to the exposure was not limited to this. Click to Pray API also suffered a separate weakness, which affected the email verification process. A vulnerability in this API allowed attackers to potentially verify an account's email address without access to the actual inbox, resulting in multiple points of vulnerability within the application's account system.  Combined with the IDOR flaw, the vulnerabilities created multiple points of vulnerability. Researchers indicated that the vulnerability was first reported to Click to Pray and the Pope's Worldwide Prayer Network on January 3, 2026. Multiple attempts were made to contact relevant contacts, however none were received. More than six months later, the researcher contacted a journalist, who raised the issue with the Vatican. This incident is the latest in a long-standing history of security issues involving Vatican-linked applications.  A vulnerability in an application associated with the Vatican's Bluetooth eRosary app in 2019 led to the leaking of account verification PINs into web responses, resulting in the possibility of account hijacking. The latest incident illustrates the risks associated with applications handling personal information that lack adequate access controls.  Despite the fact that the Click to Pray vulnerability has reportedly been rectified, the incident raises additional concerns regarding the security testing process, vulnerability reporting processes, as well as data security within religious and public-facing digital services.

  Pet wellness brand Petco has temporarily taken parts of its Vetco Clinics website offline after a security failure left large amounts of customer information publicly accessible. TechCrunch notified the company about the exposed Vetco customer and pet data, after which Petco acknowledged the issue in a statement, saying it is investigating the incident at its veterinary services arm. The company declined to share further details. The lapse meant that anyone online could directly download customer files from the Vetco site without needing an account or login credentials. At least one customer file was publicly visible and had even been indexed by Google, making it searchable. According to data reviewed by TechCrunch, the exposed records included visit notes, medical histories, prescriptions, vaccination details, and other documents linked to Vetco customers and their pets. These files contained personal information such as customer names, home addresses, phone numbers and email addresses, along with clinic locations, medical evaluations, diagnoses, test results, treatment details, itemized costs, veterinarian names, signed consent forms, and service dates. Pet details were also disclosed, including pet names, species, breed, sex, age, date of birth, microchip numbers, medical vitals, and prescription histories. TechCrunch reported the flaw to Petco on Friday. The company acknowledged the exposure on Tuesday after receiving follow-up communication that included examples of the leaked files. Petco spokesperson Ventura Olvera told TechCrunch that the company has “implemented, and will continue to implement, additional measures to further strengthen the security of our systems,” though Petco did not provide proof of these measures. Olvera also declined to clarify whether the company has logging tools capable of determining whether the data was accessed or extracted during the exposure. The vulnerability stems from how Vetco’s website generates downloadable PDFs for customers. Vetco’s portal, petpass.com, gives customers access to their vet records. However, TechCrunch discovered that the PDF-generation page was left publicly accessible without any password protection. This allowed anyone to retrieve sensitive documents simply by altering the URL to include a customer’s unique identification number. Because Vetco’s customer IDs are sequential, adjusting the number by small increments exposed other customers’ records as well. By checking ID numbers in increments of 100,000, TechCrunch estimated that the flaw could have exposed information belonging to millions of Petco customers. The issue is identified as an insecure direct object reference (IDOR), a common security oversight where servers fail to verify whether the requester is authorized to access specific files. It remains unknown how long the data was publicly exposed, but the record visible on Google dated back to mid-2020. This marks the third data incident involving Petco in 2025, according to TechCrunch’s reporting. Earlier in the year, hackers linked to the Scattered Lapsus$ Hunters group reportedly stole a large trove of customer data from a Salesforce-hosted Petco database and sought ransom payments to avoid leaking the data. In September, Petco disclosed another breach involving a misconfigured software setting that mistakenly made certain files available online. That incident exposed highly sensitive data—including Social Security numbers, driver’s license details, and payment information like credit and debit card numbers. Olvera did not confirm how many customers were affected by the September breach. Under California law, organizations must publicly report breaches affecting more than 500 state residents. TechCrunch believes the newly discovered Vetco data exposure is a separate event because Petco had already begun notifying customers about the earlier breach months prior.