McDonald's McHire chatbot platform exposed 64 million job applications behind the password '123456'

Researchers Ian Carroll and Sam Curry logged into the McHire administrator interface for Paradox.ai's 'Olivia' hiring chatbot using the default credentials 123456/123456 on a test franchise, and an insecure direct object reference in an internal API let them read other applicants' records. The flaws exposed chat transcripts, session tokens, names, emails, phone numbers and addresses across more than 64 million applications; the issue was reported and fixed on June 30, 2025.

What this means for youAny vendor chatbot that collects customer or applicant data is a database you are responsible for, so ask vendors about default credentials and access controls before signing.