Incident Score: Analysis & Impact (MEJ1785018222)

In this Rankiteo incident briefing, we review the MEJ : Mouvement Eucharistique des Jeunes breach identified under incident ID MEJ1785018222.

The analysis begins with a detailed overview of MEJ : Mouvement Eucharistique des Jeunes's information like the linkedin page: https://www.linkedin.com/company/mej, the number of followers: 311, the industry type: Civic and Social Organizations and the number of employees: 13 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 761 and after the incident was 668 with a difference of -93 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on MEJ : Mouvement Eucharistique des Jeunes and their customers.

Pope’s Worldwide Prayer Network recently reported "Vatican-Linked Prayer App Exposed 720,000 Users’ Data Due to Zero Security", a noteworthy cybersecurity incident.

Security researcher BobDaHacker uncovered critical vulnerabilities in *Click To Pray*, the official prayer app of the Pope’s Worldwide Prayer Network, exposing sensitive user data.

The disruption is felt across the environment, affecting Click To Pray app API, and exposing 720,000 user records, with nearly 720,000 records at risk.

In response, moved swiftly to contain the threat with measures like Vulnerabilities patched after public disclosure, and began remediation that includes API security improvements (rate limiting, encryption of sensitive data), and stakeholders are being briefed through No initial response to researcher; public disclosure via Dark Reading.

The case underscores how Resolved, teams are taking away lessons such as The incident highlights the risks of overlooked security in niche applications, especially those targeting vulnerable populations like older, less tech-savvy users. Basic security measures (e.g., rate limiting, encryption) are critical even for non-commercial apps, and recommending next steps like Implement rate limiting on APIs to prevent automated data harvesting, Encrypt sensitive data (e.g., validation_hash) to prevent plaintext exposure and Establish a clear vulnerability disclosure process to respond to security researchers promptly.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.