https://merginit.com/_app/immutable/chunks/B6lluKaN.js

1import{a as r,f as i}from"./SDtLGXl7.js";import"./Bom5CQ_t.js";import{s as t,f as n,n as d}from"./BhzG5ji-.js";import{A as l}from"./C35AqIHo.js";import{I as c}from"./D3bvnAa3.js";const h={title:"McDonald's Data Breach: 64M Exposed via Paradox.ai",description:"Inside the McDonald's data breach: 64M applicants exposed via Paradox.ai and lax internal controls. Learn key security lessons, supply chain risks, and fixes.",date:"2025-08-26",categories:["cybersecurity","opinion"],published:!0,author:"Jonas Fröller",readingTime:"3 min",tags:["mcdonalds","paradox-ai","data-breach","cybersecurity","password-security","supply-chain-attack","vulnerability"]},{title:g,description:w,date:v,categories:k,published:x,author:M,readingTime:D,tags:T}=h;var p=i('<h1 id="your-data-on-the-menu"><a tabindex="-1" href="#your-data-on-the-menu">Your Data on the Menu</a></h1> <!> <h2 id="a-cascade-of-security-failures-at-mcdonalds-and-its-partners"><a tabindex="-1" href="#a-cascade-of-security-failures-at-mcdonalds-and-its-partners">A cascade of security failures at McDonald’s and its partners</a></h2> <!> <p>The personal information of an estimated 64 million McDonald’s job applicants was exposed in a security incident that reached from the fast-food chain itself into the technology partners it hires. The blunders that made it possible were simple and preventable, which is precisely what makes the story unsettling.</p> <p>The initial breach was shockingly simple. Security researchers found that McHire, the recruitment platform used by many McDonald’s franchisees and developed by AI hiring bot maker Paradox.ai, had an administration account with the username and password set to “123456”. That easily guessable password, combined with another vulnerability, let researchers access the personal data of millions of applicants, including names, email addresses, and phone numbers.</p> <p>Paradox.ai initially described the incident as isolated and involving a test account. Further digging uncovered a wider pattern of poor security practices. A report from Krebs on Security found that a Paradox.ai developer’s computer was infected with malware that stole hundreds of passwords, including credentials for other Fortune 500 clients of Paradox.ai and the developer’s login for the company’s single sign-on platform, with a cookie valid for months.</p> <p>The problems did not stop at Paradox.ai. Another researcher cataloged a long list of vulnerabilities inside McDonald’s own systems: a marketing hub “protected” by a client-side password, passwords emailed in plaintext, exposed API keys, and a system that let any crew member look up any employee in the company, from store managers to the CEO. The same researcher found an internal tool for franchise owners with no authentication at all for administrative functions.</p> <p>Reporting the problems proved almost as hard as finding them. One researcher had to cold-call McDonald’s corporate headquarters and guess employee names after the company’s security contact information was removed from its website. A McDonald’s employee who helped identify some of the flaws was reportedly fired for “security concerns from corporate”.</p> <p>A company’s security is only as strong as its weakest link, and that link often sits in the supply chain or in internal habits nobody filed under ‘security’. For job applicants, the takeaway is that the data handed to one recruiter can end up on a system protected by a password like “123456”. For companies, the fix is unglamorous: real internal controls and reporting channels that do not get the messenger fired. Reporters who dig up holes like these should not have to find the security team by cold-calling the front desk.</p> <div id="research-sources"><h2 id="sources"><a tabindex="-1" href="#sources">Sources</a></h2> <p><a href="https://ian.sh/mcdonalds" rel="nofollow">Would you like an IDOR with that?</a><br/> <a href="https://krebsonsecurity.com/2025/07/poor-passwords-tattle-on-ai-hiring-bot-maker-paradox-ai" rel="nofollow">Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai - Krebs on Security</a><br/>

1 <a href="https://bobdahacker.com/blog/mcdonalds-security-vulnerabilities" rel="nofollow">How I Hacked McDonald’s (Their Security Contact Was Harder to Find Than Their Secret Sauce Recipe)</a></p></div>',1);function _(o){var e=p(),a=t(n(e),2);l(a,{});var s=t(a,4);c(s,{src:"/blog/26082025-your-data-on-the-menu-mcdonalds-security-failures/mcdonalds-locations-map.png",alt:"A map illustrating McDonald's global presence. The company's vast scale puts the 64 million breached job applicant records into perspective.",className:"my-4 rounded-lg smooth-shadow-md"}),d(14),r(o,e)}export{_ as default,h as metadata};