Security Experts:

Connect with us

Hi, what are you looking for?


Application Security

McDonald’s App Leaks Details of 2.2 Million Customers

A vulnerable application used by millions of McDonald’s customers in India was recently found to leak personal information on its users.

A vulnerable application used by millions of McDonald’s customers in India was recently found to leak personal information on its users.

Dubbed McDelivery, the web application was found to be leaking the personal information of over 2.2 million users. According to Fallible, the software security startup that discovered the bug, user data such as names, email addresses, phone numbers, home addresses, home co-ordinates, and social profile links were leaked by the application.

The issue, they reveal, resides in an unprotected publicly accessible API endpoint that was designed to deliver user details, which is coupled with serially enumerable integers as customer IDs. The pair can be used to pull the personal information pertaining to all of the application’s users.

“The mistake in this case was trivial and ought to have been fixed in a day at max. The app/website provides a facility to retrieve the current user details but does not check if the user ID being asked is the same user who has logged in. The user ID in this case is a plain number that starts from 1 and can be enumerated easily,” Abhishek Anand, Fallible co-founder, told SecurityWeek.

The vulnerability was discovered and disclosed on Feb. 7, and the company received acknowledgement from a Senior IT Manager at McDonald’s on Feb. 13, but the issue was addressed only last week, it seems. According to Fallible, however, McDonald’s fix wasn’t released in a timely manner and was also incomplete.

“We have always respected a company’s request if they wanted more time to fix any issue but sadly they stopped responding after 4 weeks which led to us warning users that their data is out in the open. In fact, the ‘fix’ applied right now is incomplete and the vulnerability exists even now and we have intimated the same to the concerned company,” Anand told us.

Over the weekend, McDonald’s published a statement on Facebook, saying that it has released an updated iteration of the McDelivery application and that it is prompting all users to update as soon as possible, as a precautionary measure.

“We would like to inform our users that our website and app does not store any sensitive financial data of the users like credit card details, wallets passwords or bank account information. The website and app has always been safe to use, and we update security measure on regular basis. As a precautionary measure, we would also urge our users to update the McDelivery app on their devices,” the statement reads.

According to Fallible, many companies in India ignore user data protection, mainly because there are no strong data protection and privacy laws or penalties. Furthermore, “there is a similar lack of push from non-government organizations to improve this scenario,” the company says. In the past, the security firm has discovered over 50 instances of data leaks in several Indian organizations.

In January, Fallible revealed that many third-party applications unnecessarily store keys or secrets that could allow attackers to access and leak data related to some of the most popular online services, including Twitter, Flickr, Dropbox, Slack, and Uber, as well as Amazon AWS (Amazon Web Services).

Related: Many Mobile Apps Unnecessarily Leak Hardcoded Keys: Analysis

Related: IT Systems Connected to Pagers Leak Valuable Data

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Application Security

While there are many routes to application security, bundles that allow security teams to quickly and easily secure applications and affect security posture in...

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

Application Security

Many developers and security people admit to having experienced a breach effected through compromised API credentials.

Application Security

A security vulnerability identified on AliExpress, the wholesale marketplace owned by the Chinese e-commerce giant Alibaba, could have been exploited by hackers to hijack...