A free chicken nugget hack helped uncover multiple McDonald's cybersecurity fails: 'All I had to do was change login to register in the URL' to access 'highly confidential and proprietary information'

Grimace, a big purple mascot from McDonalds, looks up at something off-screen.

McDonald's has once again hit the headlines with a series of cybersecurity fails, this time discovered by security researcher BobDaHacker. After alerting the company to the possibility of free chicken nuggets by taking advantage of its client-side only reward point validation system, only to be told by a software engineer they were "too busy" to take a report, the intrepid security expert decided to take a closer look at McDonald's cybersecurity overall—and came away with a litany of potential breach points.

First up was the McDonald's Feel-Good Design Hub, a central platform for brand assets and marketing materials (via Tom's Hardware). BobDaHacker reported to the company that its client-side password policy was a potential security risk, which McDonald's duly began working on over the next three months.