2025 McHire/Paradox.ai breach — 64M job applicant records
Data compromised
Names, emails, phone numbers, resumes, chat transcripts, personality test responses
Technical writeup
Security researchers discovered catastrophic flaws in McDonald's AI hiring platform McHire (powered by Paradox.ai's Olivia chatbot). An administrator account used default password '123456' with no MFA. IDOR vulnerability allowed access to applicant records by manipulating URL IDs. Exposed: names, emails, phone numbers, resumes, chat transcripts, personality test responses. ~90% of franchises using McHire potentially affected.
Root cause
Weak default credentials; IDOR vulnerability