Basic ‘123456’ Password of AI Chatbot Poses Data Risk for Millions of McDonald’s Job Applicants

Security experts have found a way to access the personal details of 64 million individuals who applied for positions at McDonald’s, primarily by logging into the company’s AI recruitment chatbot with the username and password “123456.”

In a blog entry, Ian Carroll and Sam Curry revealed that “during a short security evaluation lasting a few hours,” they identified the password vulnerability along with another straightforward security flaw in an internal API, granting access to job applicants’ past interactions with the McHire chatbot, created for McDonald’s by Paradox.ai.

The personal details accessed by the researchers included applicants’ names, email addresses, home addresses, and phone numbers.

Paradox.ai stated in a blog post that it rectified the issues “within a few hours” after being alerted by the researchers, and confirmed that “at no time was candidate information exposed online or made publicly accessible.”

The researchers’ findings were first reported by Wired.