Case mchire-paradox-exposureModel & data leakUnited States
McDonald's McHire AI hiring bot exposed up to 64M applicant records via '123456' login
Researchers accessed the admin panel of the Olivia hiring chatbot with default 123456 credentials and an IDOR flaw, exposing chat logs and contact data tied to up to 64M applications.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 9, 2025
- Location
- United States
- Target
- McDonald's / Paradox.ai
- Severity
- High
- Triggered by
- Security researchers Ian Carroll and Sam Curry (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Researchers accessed the admin panel of the Olivia hiring chatbot with default 123456 credentials and an IDOR flaw, exposing chat logs and contact data tied to up to 64M applications.
Impact: Names, emails, phone numbers, addresses and chatbot transcripts tied to up to 64 million McHire applications were reachable; Paradox said only the researchers accessed a portion of records
Who triggered it
Actor: Security researchers Ian Carroll and Sam Curry (responsible disclosure)
Attribution: Self-disclosed by the researchers; confirmed by Paradox.ai and McDonald's
Motive: Security research; no malicious access reported
How it happened
Attack vector: Default credentials 123456/123456 on a Paradox.ai test franchise account in the McHire admin portal, plus an IDOR on an internal API allowing lead_id enumeration
Root cause: Unchanged default test credentials on a production-connected admin portal and missing authorisation checks on an applicant-data API
Timeline
- Researchers find the flaws and report to Paradox.ai and McDonald's
- Default credentials disabled and IDOR fixed the same day, per McDonald's and Paradox.ai
- Public disclosure via Wired and BleepingComputer; Paradox.ai announces a bug bounty programme
Response
Paradox.ai and McDonald's fixed the issues the day they were reported; Paradox launched a vulnerability disclosure bounty programme
Current status: Patched
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- CSO Online csoonline.com
- Cyber Daily cyberdaily.au
Cite this case
McDonald's McHire AI hiring bot exposed up to 64M applicant records via '123456' login. AI Threat Watch, case mchire-paradox-exposure, Jul 9, 2025. https://aithreat.io/cases/mchire-paradox-exposure/
Permanent link: https://aithreat.io/cases/mchire-paradox-exposure/