64 million records behind "123456"

64 million people applied for a job. Their names, phone numbers, email addresses and chat transcripts all sat behind the password “123456”.

This wasn’t a nation-state attack. No zero-day. No sophisticated malware. A researcher typed “123456” into an admin login field and walked straight in. That’s the McDonald’s McHire breach: real, documented, and fixed within 24 hours once reported.

Here’s what I can’t stop thinking about. We spend millions on Zero Trust architecture, AI-powered threat detection and red-team exercises, and somewhere in the same enterprise a vendor’s test account still has default credentials. Nobody noticed.

Netskope’s 2026 Cloud and Threat Report found the average organisation records 223 GenAI-linked data policy violations every month. GenAI users grew 200% in a year, and 47% of people using these tools do so through personal, unmanaged accounts, completely outside enterprise controls.

That’s not a user behaviour problem. That’s a visibility and governance gap at scale.

The real attack surface isn’t your firewall. It’s every third-party AI tool an employee signed into, and every OAuth permission they clicked through without reading.

One question worth asking your security team this week: how many AI tools are touching your data right now, and how many of those vendors did you actually vet?

If the answer isn’t immediate, you have your answer.