A pair of security researchers has revealed vulnerabilities in the McHire chatbot Paradox, developed for McDonald's, that could have been exploited to reveal personal information about roughly 64 million people who have used the service to apply for jobs at their local franchises. (Hat-tip Wired.)
I was "hacked" the first time when I was 14. I put that in scare quotes because the password for the account was "1234." (Without the quotes or period, of course, which makes it even worse.) After I regained access to the account, I started using a password manager.
- Name, email address, phone number, address
- Candidacy state and every state change/form input the candidate had submitted (shifts they could work, etc)
- Auth token to log into the consumer UI as that user, leaking their raw chat messages and presumably other information
Carroll and Curry noted that Paradox had previously bragged that 90% of McDonald's franchises were using McHire as part of their hiring practices. (That link still leads to the appropriate post on Paradox's blog, but the section related to McDonald's has been removed, and neither the Wayback Machine nor Google's cache has saved old versions of the post. Weird!)
So let's compare and contrast. I secured a forum account with the password "1234" when I was a teenager; that account's compromise was ultimately meaningless. Paradox raised $200 million in 2020, McDonald's has a $213 billion market cap, and McHire's flaws exposed information about tens of millions of people. But at least their password was two characters longer!
Perhaps the only bright side is that Carroll and Curry said the McHire vulnerabilities were addressed a day after their disclosure. Hopefully the companies involved will hold themselves to a McHigher standard now.
