Quran app data breach exposes millions of Muslims to privacy risks

A Turkish app, Quran Kuran, has exposed over 3.6 million highly sensitive user records due to an unprotected Elasticsearch server, according to a report by Cybernews.

The app, developed by Istanbul-based Sigma Telecom and downloaded over 1 million times from the Google Play Store, helps users study the Quran and engage in prayer practices.

The leaked data included geolocation details, device identifiers, IP and MAC addresses, SIM serial numbers, and carrier information—leaving users vulnerable to identity theft, surveillance, and tracking.

Cybernews researchers warned that such information could be exploited to locate users’ residences or monitor movements, particularly during sensitive events like protests.

According to the report, this incident echoes past concerns about data misuse in prayer apps, with reports in 2020 revealing the U.S. government had purchased location data from similar platforms. The Quran Kuran developers have since secured the exposed data, but they have yet to issue a formal response.