Breachesby GlyphParadox.ai
Disclosed Jul 9, 2025Confirmed
McHire AI hiring chatbot admin flaw exposed McDonald's applicant chats
Researchers found the McHire admin interface built by Paradox.ai accepted default 123456 credentials and an IDOR flaw let them reach records they said covered up to 64 million applicants. Paradox said it fixed the issue within hours and that only five candidates' records were actually viewed, all by the researchers.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Jul 9, 2025 |
| Discovered | Jun 30, 2025 |
| Attack | Exposed data |
| Data exposed | NamesEmailsPhone numbersEmploymentMessages |
| Sector | AI · US |
| Status | Confirmed |
Sources
Notices filed
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.