AI hiring chatbot hack violates applicants' privacy

A group of hackers gained access to AI recruitment chatbot Chattr, revealing sensitive information about job applicants, fast food franchises, and Chattr itself. Pseudonymous hacker MRBruh and others discovered that Chattr had inadvertently exposed data about itself, its customers - specifically Chick-fil-A and Subway - and their job applicants, through an incorrect Firebase configuration, including personal names, telephone numbers, email addresses, passwords, and messages. The hack also revealed how Chattr's system worked, including the AI appearing to have the ability to accept or deny job applicants automatically. Chattr secured its system after the hack was made public, though failed to acknowledge publicly the incident. The incident prompted suggestions that Chattr is likely one of many AI companies to have overlooked security and data privacy in the rush to get their products to market. System 🤖 Chattr Operator: Applebees, Arbys, Chick-fil-A, Dunkin Donuts, IHOP, KFC, Shoneys, Subway, Tacobell, Target, Wendys Developer: Chattr Country: USA Sector: Business/professional services; Food/food services Purpose: Recruit employees Technology: Chatbot; NLP/text analysis; Neural network; Deep learning; Machine learning; Reinforcement learning Issue: Confidentiality; Privacy; Security Investigations, assessments, audits 🧐 MrBruh ( 2024). How I pwned half of America’s fast food chains, simultaneously

Date it happened

2024-01-01

Organisation involved

Applebees, Arbys, Chick-fil-A, DunkinDonuts, IHOP, KFC, Shoneys, Subway, Tacobell, Target, Wendys

Product, system or model

Chattr

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.