Privacy News
McDonald's AI Hiring Bot Exposed 64 Million Applications. The Password Was "123456".
August 2026
McDonald's uses an AI chatbot called Olivia to screen job applicants — collecting names, contact details, chat transcripts, and application histories from millions of people applying for hourly jobs. Security researchers found they could get into the backend admin panel using one of the oldest tricks in the book: the login was "admin", and the password was "123456". Sixty-four million applicant records were sitting behind it.
Not a nation-state hack. Not a zero-day exploit. A password a teenager wouldn't use for a school forum account, protecting the personal data of millions of job seekers at one of the largest companies in the world.
This isn't really a story about McDonald's
It's tempting to read this as "haha, McDonald's messed up," and move on. But the actual point is more uncomfortable: this is a company with essentially unlimited resources to get security right, and it still came down to a password anyone could guess on the first try. If an organization that size can get the fundamentals this wrong, "this company takes your privacy seriously" isn't something you can take on faith — not because companies are lying, but because good intentions don't prevent bad passwords, misconfigured databases, or an intern who forgot to change a default login.
The pattern keeps repeating
We wrote recently about an AI chat app that exposed 300 million private messages the same way — not through some sophisticated attack, but through a database nobody locked down properly. Different company, different product, same root cause: data was collected and stored somewhere, and "somewhere" turned out to be reachable by anyone who looked.
Why this shapes how we build
Every app we make follows the same rule: if data never leaves your device, it can't sit in a database with a weak password, because there's no database holding it in the first place. That's not a claim about how careful we are — we could be careless too. It's an architectural choice that removes an entire category of failure. We've tested this on our own apps and published the raw results, because "trust us" shouldn't be the whole pitch.
More from Offgrid Studio
Also read: 50 Million People Thought Their AI Chats Were Private. They Weren't. and What Popular Transcription Apps Actually Do With Your Recordings.