McDonald’s has become the latest global brand caught in the fallout of poor cybersecurity practices, after its AI-powered hiring chatbot, McHire, exposed around 64 million job applicant records.
The chatbot, developed by Paradox.ai and widely used across McDonald’s franchisees, was left vulnerable because of a default password (“123456”) and a misconfigured API. It is a reminder that even the most advanced tools can be undone by basic oversights.
McHire is designed to speed up recruitment by helping applicants apply, schedule interviews and answer screening questions. But behind the scenes, its security was alarmingly weak. With default login details left unchanged and APIs left open, personal information was accessible to anyone who knew where to look.
Reports suggest the breach exposed highly personal information, including names, contact details, employment history, and potentially demographic data provided during applications. For many affected applicants, often young people applying for their first jobs, this represents a serious breach of trust.
The McHire leak is more than an isolated mistake. It shows how quickly businesses are adopting AI-driven tools without putting the right guardrails in place. The lesson here is simple: AI does not eliminate the need for cybersecurity basics. Default passwords, misconfigured APIs and unchecked access remain the easiest ways for attackers to walk straight in.
Recruitment platforms process millions of applications each year. As more businesses embrace AI to cut costs and speed up hiring, the attack surface will only grow. Companies need to treat applicant data with the same care and security standards as they do customer payment data. Anything less puts both people and brand reputation at risk.
Technology only works when it is secure. Whether you are running a chatbot, a cloud platform or a workplace app, the basics still matter. Update default passwords, lock down your APIs, and make security part of your design from day one.
AI can help businesses move faster, but security needs to move with it.
