Bugs in a major McDonald’s India delivery system exposed sensitive customer data

Researcher-discovered insecure APIs in McDelivery (McDonald’s India West & South) allowed unauthorized access to customers' full names, emails, phone numbers, driver vehicle numbers, profile pictures, and real-time driver locations, and enabled order hijacking and creation of nearly free orders; the issues were reported in July and fixed in late September, with McDonald’s stating logs show no confirmed breach.