Hackers Access Personal Data of Millions of McDonald's Job Applicants Thanks to Absurdly Easy-to-Guess Password The personal data of millions of job-seekers on McDonald's AI-powered "McHire" site was made vulnerable.
By David James
McDonald's job applicants are not lovin' it.
Wired reports that the company site, McHire.com, built by AI software firm Paradox.ai, had security flaws that exposed the personal data of "tens of millions of McDonald's job-seekers."
The records of "Olivia," the chatbot that applicants interacted with, were easy for hackers to access, writes Wired. It was "as straightforward as guessing the username and password '123456.'" As many as 64 million records were left vulnerable, containing applicants' names, email addresses, and phone numbers.
Related: McDonald's Is Hiring a Massive Number of Workers
The security weakness was made public by independent security researchers Ian Carroll and Sam Curry. Carroll told Wired that they were initially drawn to check out Mchire.com due to its "uniquely dystopian" hiring process. "So I started applying for a job, and then after 30 minutes, we had full access to virtually every application that's ever been made to McDonald's going back years," Carroll said.
Paradox Chief Legal Officer, Stephanie King, told Wired, "We do not take this matter lightly, even though it was resolved swiftly and effectively," adding, "We own this."
McDonald's released a statement, which read in part: "We're disappointed by this unacceptable vulnerability from a third-party provider, Paradox.ai. As soon as we learned of the issue, we mandated Paradox.ai to remediate the issue immediately, and it was resolved on the same day it was reported to us."
Good thing the Hamburgular hadn't logged on that day.
