Jones Day Hit by Phishing Attack, Client Data Accessed in Breach Claimed by Cybercriminal Group Global law firm Jones Day confirmed a phishing attack in which hackers accessed files belonging to 10 clients, a breach later claimed by the cybercriminal group Silent. The incident, disclosed on Monday, involved unauthorized access to a limited set of dated client documents, according to a statement from spokesperson Dave Petrou. All affected clients have since been notified, though their identities remain undisclosed. Silent, a known extortion-focused threat group, listed Jones Day as a victim on its dark web leak site, taking credit for the attack. The firm, which has previously faced cybersecurity incidents including a 2021 breach with undisclosed details represents high-profile clients such as Goldman Sachs, McDonald’s, and General Motors. No further information on the scope of the compromised data or the timeline of the attack has been released. The incident underscores the persistent targeting of legal firms by cybercriminals seeking sensitive corporate information.

A series of critical vulnerabilities in McDonald’s digital infrastructure exposed severe security lapses across multiple systems. The flaws began with a client-side validation bug in the mobile app, allowing free food exploits, but escalated to far graver issues. The Design Hub, used by teams in 120 countries, relied on a client-side password and had an open registration endpoint, enabling unauthorized access to confidential brand assets. Plaintext password emails, exposed Magicbell API keys, and listable Algolia search indexes leaked employee and user data, including names, emails, and access requests.Employee portals were equally compromised: low-level staff could access the TRT corporate tool to search global employee details (including executives’ emails) and exploit an impersonation feature. The Global Restaurant Standards (GRS) panel lacked authentication, allowing API-based HTML injection, while misconfigured Stravito access exposed internal documents. A separate vulnerability in McDonald’s AI-powered hiring system exposed 64 million job applicants’ personal data due to weak security (password: '123456'). Though most issues were patched post-disclosure, some endpoints remained accessible, and a collaborator was terminated over 'security concerns.' The incident highlights systemic failures in authentication, access control, and secure coding practices, with no bug bounty program or reliable reporting mechanism in place.

A vulnerability in McHire, the AI-powered recruitment platform used by a vast majority of McDonald’s franchisees, exposed the personal information of over 64 million job applicants. The vulnerability allowed unauthorised access to sensitive data, including names, email addresses, phone numbers, and home addresses. The issue was due to an Insecure Direct Object Reference (IDOR) on an internal API and weak default credentials. The incident was swiftly addressed by Paradox.ai and McDonald's, but it highlighted the risks associated with rushing AI deployments without proper security measures.

McDonald's shares dropped by as much as 1.7% after equity analysis firm Redburn Atlantic downgraded its stock rating from buy to sell. The downgrade was due to the potential impact of GLP-1 drugs on eating habits, which could result in a loss of up to 28 million customer visits and a revenue loss of $482 million per year. The drugs, which suppress appetite and regulate blood sugar, are expected to significantly affect lower-income consumers, a key demographic for McDonald's. This change in consumer behavior, combined with inflationary pressures and pricing fatigue, poses a significant threat to the company's earnings.

One of the service providers McDonald hired in its Costa Rica branch left its client data exposed which resulted in a data breach incident. The hackers accessed client names, marital status, address, email, document identification numbers, and phone numbers from an unprotected database. McDonald’s has informed the local legal authorities and started the investigation.

The burger chain McDonald was targeted by hackers in a cyber attack. The hackers infiltrated its systems and stole personal data of employees in South Korea and Taiwan. The breach even compromised business contact information for U.S. employees and franchisees and restaurant information.

ShinyHunters Hacking Group Targets Major Organizations, Including Education Sector The cybercriminal group ShinyHunters, named after the rare "Shiny" Pokémon sought after by players, has emerged as a significant threat since 2020. According to threat intelligence from Ransomware.live, the group has compromised 104 victims across 14 countries, stealing trillions of records. The majority of attacks 73 incidents have targeted U.S.-based organizations, including high-profile names such as Microsoft, Ticketmaster, Google, Cisco, AT&T, McDonald’s, Disney/Hulu, Harvard, and Princeton. One of the group’s most disruptive attacks involved Instructure’s Canvas Learning Management System (LMS), which serves educational institutions. The breach exploited a vulnerability in the Free for Teacher environment, a no-cost version of Canvas that allows independent educators to manage classes. Following the attack, Instructure temporarily disabled the service while conducting a security review. The incident highlights broader risks posed by centralized digital ecosystems and third-party dependencies, demonstrating how modern extortion operations can disrupt critical sectors even beyond education. While technical details remain limited, the attack underscores the growing threat of sophisticated cybercriminal groups targeting both corporate and institutional infrastructure.

McDonald's Canada has acknowledged that hackers have taken approximately 95,000 job seekers' personal information from its hiring website. The names, addresses, emails, phone numbers, employment histories, and other personal information of job hopefuls were exposed in a data breach; the corporation has opened an inquiry into this incident. Approximately 95,000 restaurant job applicants' personal information has been leaked as a result. Those who applied online for a job at a McDonald's Canada restaurant are the ones who are affected. Thankfully, McDonald's Canada does not request sensitive data like social security numbers, health information, or financial information, so the recruitment website has been shut down.

The burger chain McDonald's was targeted by a cyber attack in September 2016. An employee of McDonald's who worked at the drive-thru took 100 credit card numbers. McDonald’s has informed the local legal authorities and started the investigation.

The burger chain McDonald's Canada suffered from a data breach incident that leaked 95,000 job seekers information. The information includes the names, addresses, email addresses, phone numbers, and employment backgrounds of candidates who applied online for a job at McDonald’s Canada between March 2014 and March 2017. After learning of the attack, McDonald's pulled down the website, and the corporation affirmed that it will be shut until the investigation is over.