Notifications
Clear all
Topic starter
02/08/2026 12:30 pm
TL;DR: McDonald’s AI hiring platform McHire exposed millions of applicant records after researchers used default credentials and found no MFA, while an IDOR flaw enabled access to more than 64 million chat records, according to Unixi. The breach shows that basic identity controls still fail at scale when credential hygiene and object-level authorisation are weak.
NHIMG editorial — based on content published by Unixi covering the McDonald's McHire breach: McDonald's Data Breach Exposes Millions What Went Wrong In July 2025
By the numbers:
- more than 64 million chat records including sensitive applicant information such as names, email addresses and phone numbers
- 88 percent of attacks against basic web applications involved the use of stolen credentials
Questions worth separating out
Q: What breaks when a platform still relies on default credentials?
A: Default credentials destroy the trust boundary before any deeper control can help.
Q: Why do weak credentials and IDOR create a larger breach than either flaw alone?
A: Weak credentials open the door, but IDOR determines how far the attacker can move once inside.
Q: How do security teams know if API authorisation is actually working?
A: They should test whether each identity can only complete the specific actions it is supposed to perform, then compare that result with runtime logs and anomaly patterns.
Practitioner guidance
- Eliminate default access paths before launch Inventory every admin, support, and break-glass account, then remove any default username and password combinations from production systems and test environments.
- Require MFA on all privileged workflows Apply MFA to administrative logins, support consoles, and any browser-based workflow that can retrieve applicant, customer, or internal records.
- Test for object-level authorisation failures Run IDOR testing against record identifiers, session-bound APIs, and export functions to confirm that changing an object reference never exposes another subject’s data.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- The exact McHire attack path and the sequence researchers used to reach administrative access.
- The full explanation of the IDOR weakness and how it exposed applicant chat records at scale.
- The article's discussion of passwordless access and the vendor's product context for browser-based applications.
- The additional references to malware and stolen credentials dating back to 2019.
👉 Read Unixi's analysis of the McHire breach and credential failure chain →
McHire breach: what it means for IAM teams and passwordless migration?
Explore further
02/08/2026 1:28 pm
Default credentials are not a convenience problem. They are an identity assurance failure. The breach worked because the system trusted a credential pattern that should never have reached production. Once default access exists, MFA becomes a partial mitigation rather than a baseline control, and the organisation has already accepted avoidable identity risk. The practitioner conclusion is simple: if default credentials still exist, the access model is already broken.
A few things that frame the scale:
- From our research: 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 45% of organisations cite lack of credential rotation as the top cause of NHI-related attacks, according to the same research.
A question worth separating out:
Q: Who is accountable when applicant data is exposed through weak identity controls?
A: Accountability usually sits with the application owner, the identity team, and the security function together because the failure spans authentication, authorisation, and lifecycle governance. If default credentials remain active or MFA is not enforced, the organisation has accepted preventable exposure. Compliance reviews should map that responsibility to the control owner, not only to incident response.
👉 Read our full editorial: McHire breach shows default credentials still break identity controls
