Others have said it's for the global site, but would 64 million really be that off for the US?
I just looked it up 13 of the 40k francises are in the US. Assuming linearity, thats about 21 million US applicants since they started keeping centralized, digital records.
20% of Americans younger than 40 is not a bad guess.
2 shifts of 12 employees is 24 employees per day. Assume they all work there for 6 months on average, then if the system's been up for 10 years, that's 480 employees per franchise over a decade. Which means for every employee they hired, 2 were either rejected or chose not to work there.
Working at McD's is something a lot of people do for a few months when they're young.
If this was disclosed via a vulnerability disclosure or bug bounty program and there are no indicators of a data breach then it's effectively like the findings from a pen-test so very likely no regulatory reporting requirements.
Others have said it's for the global site, but would 64 million really be that off for the US?
I just looked it up 13 of the 40k francises are in the US. Assuming linearity, thats about 21 million US applicants since they started keeping centralized, digital records.
20% of Americans younger than 40 is not a bad guess.
Which is 1,615 applicants per US franchise.
Seems totally reasonable to me.
2 shifts of 12 employees is 24 employees per day. Assume they all work there for 6 months on average, then if the system's been up for 10 years, that's 480 employees per franchise over a decade. Which means for every employee they hired, 2 were either rejected or chose not to work there.
Working at McD's is something a lot of people do for a few months when they're young.
Also is the unit identifier for a human an email? Then one living being might be seen twice or more
No its 64 million chatbot interactions that instantiated it at all
Its not as deep as the guesses
Maybe it includes applications outside the US?
They use this site for hiring globally. The number of privacy regulators they will have to notify and deal with is going to make this messy.
If this was disclosed via a vulnerability disclosure or bug bounty program and there are no indicators of a data breach then it's effectively like the findings from a pen-test so very likely no regulatory reporting requirements.