‘123456’ Password Exposed Millions of McDonald’s Job Applicants

Job applicants don’t always interact with a real person first. Just look at McDonald’s process, which deploys ‘Olivia,’ an AI-powered recruitment chatbot to streamline hiring.

But this futuristic convenience recently concealed a shocking security failure. A major data breach exposed the personal information of millions of job seekers, and it wasn’t due to a sophisticated AI-powered attack. Instead, it was due to shockingly basic flaws, including a password as simple as “123456.”

The incident, involving McDonald’s and its AI technology partner, Paradox, is a stark reminder that as companies integrate complex AI solutions into their operations, they often remain profoundly vulnerable to the simplest of human errors. It’s a case study in the importance of third-party vendor security, foundational cyber hygiene, and the ever-present human element in an organization’s security posture.

Say ‘Hello’ to a Bot Named Olivia

Olivia, an AI chatbot developed by Paradox, is at the heart of the McHire platform used by many McDonald’s franchises. It acts as the initial gatekeeper, engaging candidates, collecting personally identifiable information (PII) like names, phone numbers, and email addresses, and directing job applicants toward personality tests and interviews.

McDonald’s automated process caught the attention of security researchers Ian Carroll and Sam Curry, whose investigation didn’t start with a malicious tip but rather professional curiosity.

In the report, Carroll described a “uniquely dystopian” hiring experience. After seeing complaints online about the bot’s inefficiency and clunky interface, he and Curry decided to take a closer look.

It’s a valuable lesson in itself: A poor user experience and buggy front-end is sometimes the smoke that signals a much deeper fire in a system’s security architecture.

First Domino: Gaining Access with a Super-Simple Password

The researchers began by probing the McHire.com web domain. Their initial reconnaissance quickly uncovered a login portal seemingly intended for employees of the AI vendor, Paradox, to manage the system.

What they discovered next was alarming.

After a few attempts, they successfully gained administrative access to a test restaurant account. The credential? None other than “123456” for both the username and the password.

It’s a single point of failure that highlights two catastrophic, yet elementary, security mistakes. First, the existence of such a glaringly weak and common password on any system, let alone one connected to a platform handling millions of personal records, is inexcusable. Second, the account was not protected by multi-factor authentication (MFA), a foundational security control that would have stopped this intrusion dead in its tracks.

In a later statement, Paradox admitted this was an old, unused test account that “should have been decommissioned.” But it wasn’t, and this forgotten, insecure key was left in the lock.

Second Vulnerability: Turning a Small Crack into a Canyon

Gaining access to a test account was only the first domino that the researchers found. Carroll and Curry found a second, equally severe vulnerability known as an insecure direct object reference (IDOR).

In simple terms, this is a flaw where a web application uses an internal identifier, like an ID number, in the URL to access data. A secure system ensures a user can only access objects they’re permitted to see, and the McHire platform failed this crucial test.

The researchers found they could simply change the applicant ID number in their web browser’s address bar to view the complete application records and chat logs of other real applicants. By iterating through the numbers, they could systematically pull the personal data of anyone who applied through the system.

The potential scale of the exposure was massive: Carroll and Curry estimate that up to 64 million applicant records containing full names, email addresses, and phone numbers were accessible through this flaw.

Why This Low-Level Data Carries High Risk

Businesses typically downplay a breach that ‘only’ exposes names, emails, and phone numbers, comparing it to a phone book. But this is a dangerously outdated perspective.

In the hands of cybercriminals, this low-level PII is the perfect fuel for highly effective and targeted social engineering attacks.

The most potent threat is a large-scale, sophisticated phishing campaign. Imagine a scammer sending an email or text message to a recent applicant that reads:

“Hi Justin,

This is the McHire Team at McDonald’s. We’re impressed with your application and would like to proceed.

Please click here to enter your bank information for direct deposit so we can finalize your onboarding.”

Because the scammer knows the person’s name and the fact that they applied to McDonald’s, the message has a powerful air of legitimacy. An eager and hopeful job seeker is far more likely to fall victim, handing over their financial data without a second thought.

That’s how simple ‘simple’ data is weaponized to cause significant financial and personal harm.

Aftermath: Finger-Pointing & Fixes

McDonald’s issued a statement placing the responsibility squarely on its third-party provider, stating, “We have been notified by our vendor Paradox of an unacceptable vulnerability.”

For its part, Paradox took ownership of the technical failure. It confirmed the researchers’ findings, commendably fixed the critical vulnerability the same day it was disclosed, and announced an intention to launch a formal bug bounty program to encourage future security research.

While their swift remediation is positive, the incident underscores the immense trust companies place in vendors and the cascading consequences when that trust is broken by poor security practices.

A Human Firewall is the Strongest Defense Layer

The McHire data breach offers a vital lesson for CISOs and their teams. It was not an AI failure; the technology worked as designed.

Instead, a sophisticated hiring tool was completely undermined by a forgotten password and a decade-old web vulnerability that should have been caught in development.

The employee at Paradox who set the “123456” password represents a critical gap in security culture and awareness, and the millions of job applicants who were exposed and could’ve been targeted by a variety of phishing attacks represent the end users who are the ultimate victims of these failures.

This is where Adaptive Security comes in. In the age of AI, IT and security teams recognize the need for a partner that prepares an organization's most valuable asset — its people — for the barrage of AI-powered phishing attacks emerging across every channel.

Adaptive Security’s next-generation platform for security awareness training and phishing simulations is built for this seismic shift in cybersecurity. The human firewall is the strongest defense layer, and our platform delivers continuous, engaging training that builds a resilient workforce. Employees transform from a potential vulnerability to a core strength of the organization’s security posture, identifying and stopping threats before they result in a breach.

Don’t let a simple, preventable mistake like simple passwords and basic web flaws become the next headline. Take security awareness training to the next level — schedule a demo with Adaptive Security.