Security researchers have revealed that McDonald’s job application platform, powered by the AI chatbot “Olivia”, exposed the personal information of potentially tens of millions of applicants due to basic security flaws.

The breach, disclosed by hackers Ian Carroll and Sam Curry, was made possible using one of the most notorious password sequences: “123456”. The compromised platform, McHire.com, is managed by AI software firm Paradox.ai and is widely used by McDonald’s franchisees to streamline the job application process.

By accessing a forgotten test account with admin credentials, the researchers found that they could retrieve identifying details such as names, phone numbers, and email addresses. The pair navigated through application ID numbers, revealing chat histories and private data associated with millions of users. Paradox.ai and McDonald’s have both downplayed the actual exposure, stating the researchers only viewed a limited number of records.

However, the ease of access and implications for fraud and identity theft have prompted a wider discussion on corporate responsibility, third-party vendor oversight, and the real risks of automating hiring through AI.

Why It Matters: The McHire breach is a clear example of how simple security oversights can evolve into massive privacy risks, especially when companies hand off sensitive tasks. As more businesses implement AI into their infrastructure, this incident shows how fragile those systems may be. More importantly, it underscores how cybersecurity affects entities outside corporations and the lives of everyday people.

• Security Breach Caused by Common Credential Use: Researchers accessed McHire’s backend in just two attempts, first trying “admin” and then “123456” as login credentials. They stumbled upon an old Paradox.ai test account left exposed with no multi-factor authentication or deactivation safeguards. The account granted administrator-level access and was linked to a fictitious McDonald’s location with Paradox.ai developer test data.

• Scale of Exposure: Up to 64 Million Records: Inside the system, Carroll and Curry discovered that they could manipulate job applicant ID numbers to access user records. Each ID revealed a different job seeker’s chat history, name, phone number, and email. While they limited their exploration for ethical reasons, a simple scan revealed the potential access to over 64 million applications dating back years.

• Real-World Risks of Fraud and Exploitation: The exposure did not divulge information such as Social Security numbers or bank details, but still contained highly exploitable data. Researchers warned that this information could have been effective in phishing attempts posing as McDonald’s recruiters. An attacker could easily target applicants with fake job offers or direct deposit scams by leveraging the personal data and knowledge of the hiring process.

• Corporate Reaction and Accountability: Paradox.ai confirmed the findings in a public blog post and pledged to implement a bug bounty program to catch future vulnerabilities. The company emphasized that only a few records were truly accessed, none by malicious actors. McDonald’s, in turn, placed the blame entirely on Paradox.ai, noting the issue was resolved on the same day it was reported. Both companies stated their commitment to improved cybersecurity, but neither addressed why such a critical lapse occurred in the first place.

• Broader Concerns About AI in Hiring Practices: The breach reignited concerns about the increasing use of AI in employment screening. Olivia, the AI chatbot, has been criticized on social platforms for giving nonsensical answers and misunderstanding applicants. Critics argue that AI hiring systems lack the empathy, transparency, and contextual awareness of human recruiters and now, the security safeguards. For many applicants, often young and seeking minimum-wage roles, the experience of being misunderstood or having their data exposed can be dehumanizing and discouraging.

Go Deeper -> McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data to Hackers Who Tried the Password ‘123456’ – Wired
Hackers Used Simple Password to Access McDonald’s AI Hiring Bot Applicant Data – Yahoo News