Mchacked: hackers expose 64 million applicants using mcdonald's job application chat bot

McHacked: Hackers Expose 64 Million Applicants Using McDonald’s Job Application Chat Bot

Posted by
1 min read
July 31, 2025

TRENTON— Bad news for anyone in New Jersey who might have used McDonad’s AI Chat Bot to apply for a job. Hackers have exposed your information due to a simple password used by the bot’s API interface.

A major security lapse in McDonald’s job application system has potentially exposed the personal information of more than 64 million prospective employees, according to a report highlighting two critical vulnerabilities in the platform.

McHire, the recruitment chatbot platform used by 90% of McDonald’s franchisees, is powered by Olivia, a virtual assistant developed by Paradox.ai. The system collects applicant data including personal details, shift preferences, and responses to personality assessments.

Security researchers conducting a brief review of the platform said they discovered that the McHire admin interface could be accessed using default login credentials — 123456:123456. Once inside, an insecure direct object reference (IDOR) flaw in an internal API allowed access to any applicant’s chats and contact information.

The combination of these two issues enabled users with any McHire account to view private data across the system. “Together they allowed us and anyone else with a McHire account and access to any inbox to retrieve the personal data of more than 64 million applicants,” the researchers stated.

Complaints about McHire’s chatbot had surfaced in online forums such as Reddit, where users described Olivia giving nonsensical responses, prompting the closer review that led to the discovery.

McDonald’s and Paradox.ai have not yet publicly addressed the reported security issues.

Phil Stilton is the Editor and Publisher of Shore News Network, an independent digital newsroom providing original reporting on New Jersey, national news, government, public policy, public safety, courts, and community affairs.

As founder of the publication, Stilton leads editorial strategy, investigative reporting, and daily newsroom operations while overseeing coverage that reaches millions of readers annually.

With extensive experience covering municipal government, county government, state legislatures, elections, law enforcement, emergency management, and public records, Stilton specializes in translating complex government actions into clear, factual reporting. His work frequently relies on primary source documents, including court filings, legislation, public meeting records, election finance disclosures, government databases, police reports, and Freedom of Information and Open Public Records Act (OPRA) requests. He has reported extensively on local government accountability, taxpayer spending, campaign finance, public corruption investigations, infrastructure, public safety, and the policies affecting New Jersey residents.

Under Stilton's editorial leadership, Shore News Network has grown into one of New Jersey's largest independent digital news organizations, publishing thousands of original news articles each year while providing breaking news coverage, investigative reporting, and analysis across state and local government. The publication's reporting is routinely sourced from official government agencies, public officials, court records, and firsthand documentation, with a commitment to transparency, attribution, corrections when warranted, and clearly distinguishing factual reporting from opinion.

Stilton's journalism follows established newsroom standards emphasizing accuracy, verification, fairness, and accountability. Every effort is made to verify information through official records and multiple reliable sources before publication. His reporting is intended to provide readers with timely, well-documented information that helps them understand the issues affecting their communities, while maintaining editorial independence from political parties, government agencies, advocacy organizations, and commercial interests.

Readers can submit story tips, corrections, public records, or media inquiries through the official Shore News Network website or its verified social media channels. Shore News Network welcomes corrections and updates when new information becomes available as part of its ongoing commitment to accurate and transparent journalism.

Don't Miss

Exit mobile version