Cyber-Attack on McDonald’s Canada Career Website

MEDIA STATEMENT

March 31, 2017

The McDonald’s Canada (“McDonald’s”) career website (http://www.mcdonalds.ca/ca/en/careers.html or http://www.mcdonalds.ca/ca/fr/careers.html) was recently subject to a cyber-attack.

As a result, the personal information of approximately 95,000 restaurant job applicants has been compromised. Applicants affected are those who applied online for a job at a McDonald’s Canada restaurant between March 2014 and March 2017.  The personal information compromised was limited to applicant name, address, email address, phone number, employment background and other standard application information.  Importantly, our application forms do not request highly sensitive personal information such as social insurance numbers, banking information or health information.

When we learned of this privacy breach we immediately shut down the site and launched an investigation.  The careers webpage will remain shut down until the investigation is complete and appropriate measures are taken to ensure that this type of security breach does not happen again.

While the investigation remains ongoing, all applicants who were directly affected by this privacy breach will be notified by a letter in the mail. Where a mailing address was not provided in the application form, affected applicants will be contacted by using other contact information provided on the application form (email or telephone).

At this time, we have no information that the information taken has been misused.

We apologize to those impacted by this incident.

Those interested in applying for a job should do so in person at any McDonald’s Canada restaurant, including on National Hiring Day, an annual event taking place April 5th, 2017.

Applicants impacted may call our dedicated assistance line at: 1 (877) 238-3790, which is available Monday through Friday, 9:00 a.m. to 7:00 p.m. EST and provide reference number 7827032417 when calling.

Q&A

Q. What happened?

A. The McDonald’s Canada (“McDonald’s”) career website (http://www.mcdonalds.ca/ca/en/careers.html or http://www.mcdonalds.ca/ca/fr/careers.html) was subject to a cyber-attack. The personal information of approximately 95,000 restaurant job applicants has been compromised, as a result of this privacy breach.

Q. When did this privacy breach occur?

A. We are still investigating. However, it appears that the breach occurred in mid-March 2017.

Q. When did McDonald’s Canada become aware of this incident?

A. We learned of this incident in mid-March 2017.

Q. How did McDonald’s Canada discover that the privacy breach had occurred?

A. McDonald’s Canada monitors its databases for any unauthorized access. This monitoring identified unauthorized access to the database.

Q. How many people are affected by this incident?

A. Approximately 95,000 applicants who applied online for jobs at McDonald’s Canada restaurants between March 2014 and March 2017.

Q. What personal information was taken?

A. The personal information taken was any information an applicant inserted into their application form. This information may include an applicant’s name, address, email address, phone number, employment background and other standard application information. Importantly, our application forms do not request highly sensitive personal information such as social insurance numbers, banking information or health information.

Q. Was banking information or SIN taken?

A. No. Importantly, our application forms do not request highly sensitive personal information such as social insurance numbers, banking information or health information.

Q. What did you do when you discovered the attack?

A. Several things. McDonald’s Canada immediately shut down the site and launched an investigation. We also took steps to quarantine the affected database in order to prevent any further exposure. Affected applicants will receive notifications. We have also proactively notified privacy commissioners in every jurisdiction about this security incident. The careers webpage will remain shut down until the investigation is complete and appropriate measures are taken to ensure that this type of security breach does not happen again.

Q. How will I be notified?

A. All individuals whose personal information was impacted will be notified directly by McDonald’s Canada.  Letters will be sent to affected individuals as the primary means of contact. Where a mailing address was not provided in the application form, affected individuals will be contacted by using other information that they provided to McDonald’s Canada on the application form (email or telephone). As an added measure, we have proactively announced this breach publicly to reach as wide a group of applicants as possible.

Q. What steps do I need to take if I think the email is not really from McDonald’s Canada?

A. McDonald’s Canada will only contact you by email if we have your email address, but do not have your mailing address. We will not ask you to respond to the email with a reply message. We will also not ask you to provide any personal information. If you have any concern that the email received is not from McDonald’s Canada, you may call the dedicated assistance line at 1 (877) 238-3790, which is available Monday through Friday, 9:00 a.m. to 7:00 p.m. EST and provide reference number 7827032417 when calling.

Q. If I do not get a letter, what should I do?

A. If you applied online for a job at a McDonald’s Canada restaurant between March 2014 and March 2017, you may call the dedicated assistance line at 1 (877) 238-3790, which is available Monday through Friday, 9:00 a.m. to 7:00 p.m. EST and provide reference number 7827032417 when calling. If you did not apply online, then you are not an affected applicant.

Q. If I am a guardian/parent of a McDonald’s Canada applicant who may have been affected, who can I contact?

A. We have established a call centre to assist those who may have been affected. You and the applicant may call the dedicated assistance line at 1 (877) 238-3790, which is available Monday through Friday, 9:00 a.m. to 7:00 p.m. EST and provide reference number 7827032417 when calling.

Q. If I recently applied online to a McDonald’s Canada restaurant, do I have to re-apply?

A. If you applied online in March 2017 you are encouraged to re-apply in person at your local McDonald’s Canada restaurant.