You Deserve Some Cybersecurity Today

What kind of system lets you enter 123456 twice and get 64 million in return?

That string sequence was the default username, and also the password, that gave cybersecurity researchers access earlier this year to McHire, McDonald’s AI-powered chatbot hiring platform, potentially exposing the records of 64 million applicants.

Default credentials are not a new issue in the world of cybercriminals. Nor is the debate over responsibility to check, replace, or delete them.

“Default credentials are a well-known risk. Both the organization and its vendor are typically responsible for checking and updating them,” said Adam Pilton, cybersecurity advisor at Heimdal Security. “Failures often occur when both parties assume the other will handle it, and ultimately neither does.”

News reports said McDonald’s expressed disappointment in the vulnerability of McHire, and in Paradox.ai, which built the platform. The company said it was committed to cybersecurity and to holding third-party vendors to high data protection standards. McDonald’s said it mandated that Paradox.ai address the issue immediately, and the problem was resolved on the same day. McDonald’s said there was a limited effect because only five records were viewed by the security researchers. McDonald’s did not respond to requests for comment.

Once the researchers were on the platform, they found a vulnerability they could easily exploit to obtain 64 million sets of records, including job candidates’ names, email addresses, phone numbers, home addresses, and personality tests, according to news reports.

A technical report from researchers Ian Carroll and Sam Curry said the McHire app had an Insecure Direct Object Reference (IDOR), which happens when a computer system allows users, even unauthorized users, to access or modify information by guessing or altering an ID, link, or number in a website or app. Carroll and Curry were not available for comment.

Using the default admin credentials, the researchers could see records for any applicant system-wide. This allowed access to sensitive data, which also included application responses and chat logs with the system’s AI bot. Since the system lacked proper restrictions on record access, the personal information of millions of applicants was exposed.

Paradox.ai, the McHire app provider, set up the test account in 2019, and it remained publicly available until the researchers reported on it. Paradox referred to its response link and made no other comments. A criminal cyber group could have found and entered the app at any time over the past six years, with potentially worse consequences.

Responsibility for Default Credentials

Paradox.ai had accountability the moment real data was attached to the McHire platform, according to Tony Smales, chief technology officer for ThinOps, a technology consultancy.

“Clinically, Paradox.ai created the service/test account (username 123456 / password 123456) during internal QA back in 2019 and never rolled it out of production. Because it lived in Paradox’s tenant, Paradox remained the data processor and bore the first-line duty of care once real applicant data was ingested,” said Smales.

The Paradox.ai cloud tenant infrastructure had a dormant test restaurant account, which had the weak default credentials. Developers used the test account for quality assurance purposes. The credentials ultimately gave access to the backend of the cloud service for the McHire platform that reached global candidates.

“McDonald’s is the data controller under U.S. state privacy laws, so their vendor-risk governance teams should have required proof that no hard-coded or default credentials remained before go-live. In practice, the account sat outside McDonald’s SSO boundary, so Paradox’s IAM [identity and access management] process—not McDonald’s—failed the ‘secure-by-default’ test,” said Smales.

If the default password had used Single Sign-On (SSO) authentication, only real McDonald’s staff could have accessed the data.

Exposed and Fixed

Gal Diskin, vice president of research and identity threat at Delinea, a cybersecurity company, the exposed data in the McHire case “included the applicants’ names, emails, phone numbers, IP addresses, home addresses, candidacy details, personality test responses, and chat histories. There were also session tokens exposed, which could allow for impersonating the applicants on the platform.”

Diskin said the researchers disclosed the vulnerability to Paradox.ai and McDonald’s at the same time, 5:46 p.m. ET on June 30, 2025. At 6:24 p.m., McDonald’s confirmed receipt of the notification and asked for technical details. As of 7:31 p.m., the default credentials were no longer usable to access the app.

How a Breakdown Occurs

According to Temi Adebambo, CISO at Microsoft Gaming, companies often subcontract the implementation of tools and IT services to third parties. Those third parties don’t necessarily want to change a default password for the company. When the project is handed over, the company can then change the password.

“While we were implementing as a consulting company, which I was part of for 15 years, we could just use those default passwords. That way, several members of the implementation team can walk through the implementation, using the standard documentation, with the expectation that when we finally roll this out and hand it over to the customer, one of the steps that the customer is supposed to take is to change it to a password that only they know. That’s where that breakdown sometimes lies in between,” said Adebambo.

Steps they are taking, broader industry efforts

In response to the incident, Paradox.ai said “We are launching several new security initiatives, including providing an easy way to contact our security team [sic] on our website and a bug bounty program.” No such initiatives have been announced or are underway.

Experts say Paradox.ai should have used strong, unique credentials and SSO for all admin access, which would have blocked default passwords and outside logins.

“Applied security conferences like Black Hat and DEF CON are pushing the idea of shipping products and services that are secure by default, pushing vendors to ship devices with randomly generated passwords instead of just 123456,” said Birhanu Eshete, associate professor of computer and information science at the University of Michigan-Dearborn.

Established compliance frameworks, such as SOC 2, NIST 800-53, ISO 27001, and CIS v8 outline the processes that were missing in this case, according to Ermis Catevatis, head of cloud and security architecture at Hiring Branch, which builds AI-powered tools for skill assessments.

Missing controls in McHire included user access recertification to flag or disable dormant privileged accounts; automated orphaned account monitoring, locking, or removing unused credentials; and credential rotation policies, particularly for machine-generated secrets, according to Catevatis. Controls such as MFA and complex password requirements were also missing, he said.

David Geer is a journalist who focuses on issues related to cybersecurity. He writes from Cleveland, OH, USA.