McDonald's AI-powered hiring chatbot, known as "Olivia," used by over 90% of its franchises through the McHire recruitment platform, exposed the personal data of approximately 64 million job applicants due to basic security flaws. Researchers discovered that the system was accessible using the default and easily guessable password "123456," allowing potential unauthorized access to millions of chat records containing sensitive applicant information such as names, emails, phone numbers, and interview details. The vulnerability was identified last month, and while McDonald's has stated there was no public data leak, the incident has raised concerns about the security of AI-driven recruitment tools and the protection of applicant data. The exposed records also included information on thousands of Ethereum holders among the applicants. The breach highlights the risks associated with lax security measures in AI applications within hiring processes.
McDonald’s AI-powered hiring chatbot, was configured with the default credentials 123456/123456 Exposing the personal information of around 64 million of the company’s job applicants https://t.co/HwyOIbkENa
McDonald’s “McHire” job application service was accessed by researchers last month using the password “123456,” potentially exposing more than 64 million records. #cybersecurity #infosec #ITsecurity https://t.co/VzF3ZKtBzY
Lessons Learned From McDonald's Big AI Flub: https://t.co/nViA8DkrED by darkreading #infosec #cybersecurity #technology #news