Safety researchers lately revealed that the private info of tens of millions of people that utilized for jobs at McDonald\u2019s<\/strong> was uncovered after they guessed the password (\u201c123456\u201d) for the quick meals chain\u2019s account at Paradox.ai<\/strong>, an organization that makes synthetic intelligence primarily based hiring chatbots utilized by many Fortune 500 corporations. Paradox.ai stated the safety oversight was an remoted incident that didn’t have an effect on its different prospects, however current safety breaches involving its staff in Vietnam inform a extra nuanced story.<\/p>\n A screenshot of the paradox.ai homepage exhibiting its AI hiring chatbot \u201cOlivia\u201d interacting with potential hires.<\/p>\n<\/div>\n Earlier this month, safety researchers Ian Carroll<\/strong> and Sam Curry<\/strong> wrote about<\/a> easy strategies they discovered to entry the backend of the AI chatbot platform on McHire.com, the McDonald\u2019s web site that lots of its franchisees use to display screen job candidates. As first reported by Wired<\/a>, the researchers found that the weak password utilized by Paradox uncovered 64 million data, together with candidates\u2019 names, electronic mail addresses and cellphone numbers.<\/p>\n Paradox.ai acknowledged the researchers\u2019 findings however stated the corporate\u2019s different consumer cases weren’t affected, and that no delicate info \u2014 akin to Social Safety numbers \u2014 was uncovered.<\/p>\n \u201cWe’re assured, primarily based on our data, this take a look at account was not accessed by any third get together apart from the safety researchers,\u201d the corporate wrote in a July 9 weblog put up<\/a>. \u201cIt had not been logged into since 2019 and admittedly, ought to have been decommissioned. We wish to be very clear that whereas the researchers might have briefly had entry to the system containing all chat interactions (NOT job functions), they solely considered and downloaded 5 chats in complete that had candidate info inside. Once more, at no level was any information leaked on-line or made public.\u201d<\/p>\n Nevertheless, a overview of stolen password information gathered by a number of breach-tracking providers exhibits that on the finish of June 2025, a Paradox.ai administrator in Vietnam suffered a malware compromise on their system that stole usernames and passwords for quite a lot of inner and third-party on-line providers. The outcomes weren’t fairly.<\/p>\n The password information from the Paradox.ai developer was stolen by a malware pressure often known as \u201cNexus Stealer<\/strong>,\u201d a type grabber and password stealer that’s bought on cybercrime boards. The data snarfed by stealers like Nexus is commonly recovered and listed by information leak aggregator providers like Intelligence X<\/b>, which experiences that the malware on the Paradox.ai developer\u2019s system uncovered a whole bunch of largely poor and recycled passwords (utilizing the identical base password however barely completely different characters on the finish).<\/p>\n These purloined credentials present the developer in query at one level used the identical seven-digit password to log in to Paradox.ai accounts for various Fortune 500 corporations listed as prospects on the corporate\u2019s web site<\/a>, together with Aramark<\/strong>, Lockheed Martin<\/strong>, Lowes<\/strong>, and Pepsi.<\/strong><\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/07\/paradoxai.png\")
<\/p>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/07\/hivesystems-pwdcrack.png\")
<\/p>\n