Change Your Password Day took place over the weekend, and in case you doubt the need to improve this most basic element of cybersecurity hygiene, even McDonald's – yes, the fast food chain – is urging people to get more creative when it comes to passwords.

McDonald's Netherlands operations took the opportunity on Sunday to let customers know that, when it comes to choosing a password that's easy to remember, they ought not to pick the names of its products like hundreds of thousands of other people around the world.

Drawing on data from Have I Been Pwned, McDonald's [1]said that "bigmac" and its leetspeak variants were found more than 110,922 times in the site's compromised password corpus. Other products, like "happymeal," "mcnuggets," and the generic-but-still-applicable "frenchfries" were also common, and when special character substitutions are included they occur even more frequently.

[2]

It's not unusual for internet users to take an easy-to-remember word or two and swap out an @ for an A, a 1 for an I, or other substitutions – which is part of the point McDonald's is trying to make.

[3]

[4]

[5]Youtube Video

The video also shows advertisements placed in Dutch subway stations and other public spaces informing burger lovers that even though Ch!ck3nMcN4gg€t$ might seem like a great password, it isn't.

[6]

"You're lovin' it," McDonald's tells passers-by, "but hackers too."

Simple character substitution may have been good advice back [7]at the turn of the century , but nowadays world+dog knows the basic rules for such swaps, meaning they're not a great idea, and a brute-force attempt to crack an account is going to have all of those substituted passwords in its dictionary of stuff to try.

[8]Researcher who found McDonald's free-food hack turns her attention to Chinese restaurant robots

[9]McDonald's not lovin' it when hacker exposes nuggets of rotten security

[10]iFixit to the rescue: McDonald's workers can rescue their own ice cream machines

[11]McDonald's not lovin' its AI drive-thru experiment with IBM

And while El Reg readers are tech-savvy enough to use long passphrases, randomized passwords, biometrics, MFA and a password manager - making life difficult for the legions of cybercriminals relying on laziness to break into accounts - most people aren't.

As Google noted last summer, [12]most normies are still relying on old-fashioned security measures, like nothing but a password and maybe a second authentication factor if their IT administrator is lucky. Many resist moving beyond the password as the be-all, end-all of account security.

The younger generation isn't any better – Google notes they might make more use of modern security tools, however, their passwords are still by and large [13]the same garbage that everyone's been using since the dawn of the internet.

[14]

123456 and password? Some admin users are guilty of this too.

So following Change Your Password Day 2026, let's all take a tip from the Golden Arches and keep those passwords a bit more secure, but don't stop there. Implement all the account security [15]best practices you can find while you're at it. ®

Get our [16]Tech Resources



[1] https://www.prnewswire.com/news-releases/bigmac-frequently-used-as-a-password-mcdonalds-draws-attention-to-predictable-logins-302675740.html

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aYEskQQAU4P7GIN-xSBHgwAAAVU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aYEskQQAU4P7GIN-xSBHgwAAAVU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aYEskQQAU4P7GIN-xSBHgwAAAVU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.youtube.com/watch?v=T4IcbQIyjCM

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aYEskQQAU4P7GIN-xSBHgwAAAVU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2004/05/28/password_advice/

[8] https://www.theregister.com/2025/08/29/pudu_robots_hackable/

[9] https://www.theregister.com/2025/08/20/mcdonalds_terrible_security/

[10] https://www.theregister.com/2024/10/29/copyright_office_mcdonalds/

[11] https://www.theregister.com/2024/06/17/mcdonalds_ai_drivethru/

[12] https://blog.google/innovation-and-ai/technology/safety-security/google-survey-digital-security-2025/#:~:text=Security%20practices%20differ%20by%20generation,move%20away%20from%20legacy%20methods.

[13] https://www.theregister.com/2025/11/18/zoomer_passwords/

[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aYEskQQAU4P7GIN-xSBHgwAAAVU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[15] https://www.nist.gov/cybersecurity/how-do-i-create-good-password

[16] https://whitepapers.theregister.com/