I’m Loving It, Not: McDonald’s India App Compromised 2.2 Million Users’ Data

Data security firm Fallible says McDonald’s India app has leaked personal data of more than 2.2 million users, including their names, email ids, phone numbers, home addresses, accurate home co-ordinates and social profile links.

New Delhi (Sputnik) — The McDonald’s fix is incomplete and the endpoint is still leaking data. We have communicated this again to them and are waiting for their response, data security firm Fallible said in its post on the blogging site, Medium.com.

Earlier, McDonald’s had asked the users of its McDelivery service in India to update the app as advised by Fallible.

McDonald’s India clarified the McDelivery app does not store any sensitive financial data. “We would like to inform our users that our website and app does not store any sensitive financial data of users, like credit card details, wallets’ password or bank account information,” said a McDonald’s India statement.

“The website and app has always been safe to use, and we update security measures on a regular basis. As a precautionary measure, we would also urge our users to update the McDelivery app on their devices,” the company said.

Statement from McDonalds India. pic.twitter.com/1tK5D1FACp

— McDonald's India (@mcdonaldsindia) 18 марта 2017 г.

"​When cyber criminals intrude into the app, they steal sensitive and personal information. It’s a serious threat and it basically impacts the privacy of persons using the app. When we order something from the app, it records my credit card number, my name, date of birth etc. These are sensitive personal, identifiable data which will be stored in the app. So McDonald’s should take immediate steps to plug the leak,” cyber expert Pawan Duggal told Sputnik.