McHire AI hiring bot Data Exposure

The McHire AI hiring bot, developed by Paradox.ai, suffered from basic security misconfigurations, specifically allowing unauthorized access via easily guessable weak passwords like '123456'. This critical flaw resulted in the data exposure of personal information, résumés, and contact details for tens of millions of McDonald's job applicants.

What Happened

The McHire AI hiring bot, developed by Paradox.ai, suffered from basic security misconfigurations, specifically allowing unauthorized access via easily guessable weak passwords like '123456'. This critical flaw resulted in the data exposure of personal information, résumés, and contact details for tens of millions of McDonald's job applicants.

Why This Matters

Publisher reporting describes a security event affecting Data. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether Data is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Jul 09, 2025 05:30

  BugSkan first recorded this incident.

• McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data to Hackers Who Tried the Password ‘123456’ - WIRED
  Jul 09, 2025 05:30

  wired.com · Data Leak

Sources

My Interests Match