Security researchers Ian Carroll and Sam Curry discovered a vulnerability in McDonald’s job application system, McHire, which exposed personal data for millions of applicants.

The platform, managed by AI company Paradox.ai, had basic security flaws, including a weak password.

The breach may have affected up to 64 million records containing names, email addresses, and phone numbers.

The issue was found during an investigation into Paradox.ai’s AI chatbot, Olivia.

Paradox.ai said the exposed account wasn’t accessed by unauthorized parties and that the flaw was fixed quickly. The company plans to launch a bug bounty program.

McDonald’s expressed disappointment and stressed its commitment to data protection standards.

🔗 Source: Wired

🧠 Food for thought

1️⃣ Third-party vendor security remains a critical blind spot for enterprises

The McDonald’s breach exemplifies a persistent pattern in corporate security failures: inadequate oversight of third-party vendors handling sensitive data.

Research shows 56% of companies experienced third-party data breaches in 2017, with each compromised record costing an additional $16 when third parties are involved 1.

Despite these risks, 60% of companies report feeling unprepared to verify their partners’ data security practices, and only 2% of IT experts consider third-party access a top priority 1.

This security gap exists because organizations often lack comprehensive inventories of which third parties have access to their data, with 57% of companies failing to maintain such records 1.

The McDonald’s case is particularly concerning because the vulnerable account had remained unused since 2019 but was never decommissioned, highlighting how forgotten access points can create substantial security liabilities.

2️⃣ Simple human errors continue to cause catastrophic data exposures

The use of the password “123456” that allowed access to millions of McDonald’s applicants’ data illustrates how basic security failures remain pervasive despite decades of cybersecurity awareness.