Artificial intelligence (AI) is changing everything, especially cybersecurity. But a recent data breach suffered by McDonald’s, exposing the personal information of around 64 million of the company’s job applicants, wasn’t a failure of AI so much as a failure of the most basic cybersecurity principle: never leave the front door wide open.
The fast-food giant didn’t have its information compromised as a result of sophisticated malware or a zero-day exploit. Instead, the hackers won the war with a simple guessing game. McHire, McDonald’s AI-powered hiring chatbot, was configured with the default credentials 123456/123456 to access the administration interface for McHire restaurant accounts. No MFA, no brute-force protection, nothing.
Designed by Paradox.ai and deployed across tens of thousands of restaurants globally, McHire automates much of the company’s frontline hiring, from collecting applications to conducting interviews via a bot named “Olivia.” The chatbot had access to detailed personal information on job seekers across dozens of countries, and yet it appears that the keys to its admin panel required nothing more than the most guessable password in digital history.
This wasn’t an elite attack, and that’s exactly what makes it so troubling. It didn’t involve backdoors, rootkits or polymorphic code. It involved typing “123456” into a login box and making one small tweak to a URL.
From exposed cloud environments to third-party vendor vulnerabilities, today’s cyber threats are becoming more varied and insidious. In this new digital battlefield, safeguarding your perimeter is no longer about firewalls or antivirus software. It’s about identity, integration, and insight.
Read more: Securing the Cyber Perimeter Starts With Safeguarding Corporate Emails
Passwords Make Everything Leaky as Attack Chains Move From Credentials to Chaos
For decades, enterprise cybersecurity strategies revolved around the notion of a clearly defined perimeter: secure what’s inside, keep the bad actors out. But cloud adoption, hybrid work, third-party tools, and bring-your-own-device (BYOD) policies have fragmented that perimeter into a patchwork of distributed endpoints and unseen attack vectors.
Still, the McHire breach highlights an uncomfortable truth about modern cybersecurity: while companies invest in next-generation technologies, many still fall victim to yesterday’s mistakes. In this case, the most avoidable mistake of all — using a default password — opened the door.
“It’s the tried and true advice that is often given,” Belsasar Lepe, co-founder and CEO of Cerby, stressed to PYMNTS. “Make it easy to turn on multifactor authentication for your end users. Ninety-nine percent of identity attacks are due to a lack of MFA just being turned on.”
One of Amazon’s flagship products, Amazon Web Services (AWS), last summer announced it was pushing ahead with making MFA mandatory for certain users.
Still, part of the problem lies in how technology like McHire is deployed. The McDonald’s franchise system is highly decentralized. Individual restaurant owners, not corporate headquarters, often manage the technology stack that governs hiring, scheduling, and operations. This structure creates opportunities for inconsistency — and gaps. A third-party platform like McHire may be integrated locally, configured quickly, and left largely untouched once operational. That’s how default credentials persist. That’s how no one notices until a researcher stumbles upon them.
McDonald’s did not immediately reply to PYMNTS’ request for comment.
Read more: Firms Eye Vendor Vulnerabilities as Enterprise Cybersecurity Risks Surge
Expanding Attack Surface Provides a Blueprint for Exploitation
The deeper issue can frequently lie in how enterprises view cybersecurity, especially when it comes to tools adopted outside traditional IT oversight. AI-driven tools are increasingly being implemented by line-of-business teams: HR, marketing, logistics. They’re seen as software as a service, quick to install, easy to use, and rarely scrutinized. The belief that “someone else” is handling security is pervasive.
PYMNTS reported in September that while businesses have traditionally focused on internal cybersecurity measures, today’s interconnected digital ecosystem demands a more holistic approach.
“In 2021, there were 400 data breach lawsuits filed,” Philip Yannella co-chair of the privacy, security and data protection practice at Blank Rome and the author of “Cyber Litigation: Data Breach, Data Privacy & Digital Rights,” 2025 edition, told PYMNTS. “Last year, there were over 2,000.”
“Data breaches are always the biggest danger, particularly for financial institutions … We’re going to go through a period where we see more breaches — potentially more expensive breaches — until companies can get their arms around how to deal with them,” Yannella added. “If you’re a bank, you’ve got to worry quite a bit about your vendors.”
