McDonalds McHire leak exposes millions of applicant data

pNewslettersppNewslettersppParry Sounds McDonalds located at 118 Bowes StppppppThe leak involved the McHire platform used in various countries including Canada that was found with login credentials that used 123456 as its username and password ppParry Sounds McDonalds located at 118 Bowes StppMcDonalds just got a supersized reminder to beef up its digital security after its recruitment platform allegedly exposed the sensitive data of 64 million applicantsppSecurity researchers Ian Carrol and Sam Curry known for their work in vulnerability investigations and ethical hacking recently revealed a major flaw in McDonalds new McHire recruitment platform that led to the massive leakppppMcHire the chatbot hiring app used by 90 per cent of all McDonalds franchises uses a bot called Olivia that collects applicantâs personal details resumes and shift preferences The bot also schedules interviews and administers personality testsppAccording to the report researchers discovered that an admin account used to sign in to McHirecomlogin used default credentials 123456 both as the user name and passwordppCybercriminals now have âunprecedented accessâ to personal credentials experts sayppâWithout much thought we entered 123456 as the username and 123456 as the password and were surprised to see we were immediately logged inâ the researchers saidppThe default passwordusername combination gave the researchers administrator access inside the McHire system and allowed them to see âevery chat interaction between Olivia and people that has ever applied for a job at McDonaldsâppResearchers claim the 123456 username and password combination got them backend access to troves of personally identifiable information and other sensitive data includingppâWe immediately began disclosure of this issue once we realized the potential impactâ the researchers said in the reportppAccording to the report the researchers disclosed the findings to Paradoxai the artificial intelligence software firm that built McHireâs Olivia chatbot and McDonalds on June 30 ppIn a statement Paradoxai said the default â123456â password belonged to a test account for their client which they claim was never updated and should have been decommissioned ppCybersecurity experts from IBM and Malwarebytes explain why infostealers â the malware behind ppâUnfortunately none of our penetration tests previously identified the issueâ the company admitted in the statement adding that a fix had already been deployed Paradoxai confirmed to researchers that the issues had been resolved on July 1 ppThe company claims no client information was leaked online and only the researchers were able to access it adding that the researchers only accessed the system containing chat interactions and not job applications ppIn a statement sent to Metroland Media a representative from McDonalds Canada said the issue was resolved the same day the company was made aware of it ppâWeâre disappointed by this unacceptable vulnerability from a thirdparty provider Paradoxaiâ McDonalds said in the statement ppâWe take our commitment to cybersecurity seriously and will continue to hold our thirdparty providers accountable to meeting our standards of data protectionâpp
Error Sorry there was an error processing your request
pp
There was a problem with the recaptcha Please try again
pp
You may unsubscribe at any time By signing up you agree to our terms of use and privacy policy This site is protected by reCAPTCHA and the Google privacy policy and terms of service apply
pp
Want more of the latest from us Sign up for more at our newsletter page
ppLoraine Centeno is a reporter with the Metroland Digital Content
CentreppTo join the conversation set a first and last name in your user profileppSign in or register for free to join the Conversationpp
Error There was an error processing your request
pp
There was a problem with the recaptcha Please try again
pp
You may unsubscribe at any time By signing up you agree to our terms of use and privacy policy This site is protected by reCAPTCHA and the Google privacy policy and terms of service apply
pp
Want more of the latest from us Sign up for more at our newsletter page
pp
You may unsubscribe at any time By signing up you agree to our terms of use and privacy policy This site is protected by reCAPTCHA and the Google privacy policy and terms of service apply
ppYour browser is out of date and potentially vulnerable to security risksWe recommend switching to one of the following browserspp100 Canadian Owned
 Copyright 2025 Metroland Media Group Ltd All Rights Reserved
8 Spadina Avenue Suite 10A Toronto ON M5V 0S8ppSorry an error occurredppppppppppppSign up withppppThank you ppYour account has been registered and you are now logged inppCheck your email for detailsppInvalid password or account does not existppSign in withppSubmitting this form below will send a message to your email with a link to change your passwordppAn email message containing instructions on how to reset your password has been sent to the email address listed on your accountppNo promotional rates foundpppp Taxpppp
Secure Encryptedpp
Secure transaction
Secure transaction Cancel anytime
pppp
Thank you
pp
Your gift purchase was successful
Your purchase was successful and you are now logged in You will also start receiving our free morning newsletter soon
ppA receipt was sent to your emailp