PrivacyMedium
McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability
- Occurred
- Jun 30, 2025
- Published
- Aug 4, 2025
- Source
- AI Incident Database
Summary
Researchers Ian Carroll and Sam Curry reported that McDonald's AI-powered hiring tool, McHire (using Paradox.ai's "Olivia" chatbot), could purportedly be accessed via default admin credentials and an insecure direct object reference in an internal API. The flaws allegedly allowed viewing of applicants' personally identifiable information and chat histories. McDonald's and Paradox reportedly patched the issues within a day of disclosure; Paradox stated only five records were accessed.
Developers
- Paradox.ai
- McDonald's
Deployers
- Paradox.ai
- McDonald's
Harmed parties
- Privacy
- McDonald's applicants
- Job applicants
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: AI recruitment platform exposed 64 million applicants' PII via security vulnerabilities, constituting a privacy breach.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8