I get both of you, yeah its a big company and it is a fast food restaurant. Considering that a company this big has a lot of workers that do not have that many days off during the holidays, there should still be mail read, and IT can't just up and leave for weeks. There surely have to be a few people on standby. But the IT department probably doesn't know much about the website, and for the website makers it does not make sense to be available all the time. IT could still remove the login feature(shutdown the login server) until after the holidays, provided that IT gets the message.

Conclusion: Bad excuse for a company this big, their communications being offline for so long is bad. But it is within reasonable to wait a little longer with disclosure, considering the mistakes made on the website, publisher should realise that the company hasnt put that much resources into this who security thing.

> Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site.

How many credit cards get swiped/waved per day at their PoS terminals? If they don't have a 24/7 infosec team they're Doing It Wrong™.

I'm not sure that agrees with the franchise model. McDonald's corporate owns the real estate, but not most of the businesses. So most of those terminals aren't actually theirs.

It's not as if franchisees can just choose to purchase whatever equipment they want. It all has to come from corporate, so corporate is the place to enforce security standards.

Oh wow. That model is atrocious in terms of providing decent security.