When Your Favorite Burger Becomes a Security Risk: Inside McDonald’s Password Campaign

©McDonald’s

On February 1, 2026, commuters waiting for trains in Amsterdam and Utrecht were confronted with an uncomfortable truth: their love for Big Macs might be compromising their digital security.

McDonald’s Netherlands, in partnership with TBWA\NEBOKO, launched a one-day digital out-of-home campaign that transformed subway stations into cybersecurity warnings. The execution was brutally simple — red screens displaying passwords like “Ch!ck3nMcN4gg3t$” with a single line of copy: “You’re lovin’ it. But hackers too.”

No burger photography. No golden arches dominating the frame. No “I’m lovin’ it” jingle. Just passwords displayed exactly as they’d appear in a login field, complete with character substitutions people think make them clever.

The Data Behind the Campaign

The numbers weren’t hypothetical. They were pulled directly from Have I Been Pwned, Troy Hunt’s database that tracks passwords exposed in data breaches:

• “bigmac” appeared 110,922 times
• “frenchfries” showed up 34,407 times
• “happymeal” was used 17,269 times
• “mcnuggets” appeared 2,219 times

These aren’t theoretical risks. These are actual passwords sitting in compromised databases, available to anyone who knows where to look. The campaign launched on Change Your Password Day a date most people ignore, first celebrated in 2012 after entrepreneur Matt Buchanan got hacked twice and decided the internet needed a reminder.

The Visual Strategy: Minimalism as Power

The billboards were placed exclusively in high-traffic transit corridors places where people are stuck waiting, phones in hand, unable to scroll past. The screens themselves were pure red, McDonald’s signature color that typically signals appetite and urgency. Here, it meant danger.

The password fields included lock icons and were formatted exactly as they appear during login. “B!gM@c$nCh33$e” on one screen. “Fr3nchFr!3$” on another. Each execution showing how people attempt to “strengthen” weak passwords by replacing letters with numbers and symbols — a tactic that fools no one except the person creating the password.

What’s remarkable is what they left out. No product shots. No menu imagery. No attempt to sell food. The entire campaign relied on one assumption: McDonald’s menu items are so embedded in cultural memory that seeing the word “bigmac” is enough to trigger brand recognition, even when it’s being used to illustrate a security failure.

Brand Salience as a Strategic Asset

This campaign is a masterclass in what psychologists Jenni Romaniuk and Byron Sharp call brand salience “a brand’s propensity to be noticed or come to mind in buying situations.” But McDonald’s Netherlands has figured out something more sophisticated: how to weaponize that salience for behavior change in contexts that have nothing to do with selling burgers.

Brand salience isn’t the same as brand awareness. Awareness means people recognize your brand when they see it. Salience means your brand comes to mind first when relevant. McDonald’s has spent decades building memory structures so strong that their menu items function as common nouns. “Big Mac” isn’t just a burger it’s a reference point, a cultural marker, a word people use even when they’re not thinking about McDonald’s.

The password campaign exploits this perfectly. By showing that 110,922 people used “bigmac” as a password, they’re not just highlighting a security issue — they’re demonstrating how deeply their products are embedded in people’s emotional lives. The same psychological connection that makes a brand memorable is exactly what makes your password hackable.

The Psychology of Password Choice

People don’t pick random passwords. They pick things they love. Things that make them happy. Comfort foods. Childhood nostalgia. Favorite meals. The cognitive load of remembering dozens of passwords leads people to choose memorable anchors and brands provide perfect anchors because they’re already lodged in long-term memory.

This creates a fascinating paradox: the more successful a brand is at creating emotional connections, the more likely those connections will show up in weak passwords. McDonald’s turned this vulnerability into a public service announcement, positioning themselves as self-aware enough to acknowledge their own role in the problem.

The TBWA\NEBOKO Pattern

This isn’t TBWA\NEBOKO’s first experiment with McDonald’s Netherlands in stripping away traditional advertising elements. In April 2024, they launched a scent campaign that removed everything except smell.

Blank billboards appeared in Utrecht and Leiden just McDonald’s red and yellow color blocks with no text, no logos, no imagery. Hidden compartments behind the boards stored actual french fries. Scent was blown through tubes within a 5-meter radius. People walking past instantly knew it was McDonald’s purely from the aroma.

CMO Stijn Mentrop Huliselan explained the thinking: “Scents evoke clear and emotional memories more effectively than images.” The campaign worked because McDonald’s has spent decades making their fries smell distinctive. That scent is a brand asset as powerful as their logo.

Both campaigns operate on the same principle: McDonald’s brand recognition is so deep they don’t need to show you anything. The red alone works. The smell alone works. The menu item names alone work. They can communicate the brand through a single sensory channel and trust that people will make the connection.

More recently, they launched another minimalist campaign in March 2026 photographing the actual shortcuts people have carved through parks and between buildings on their way to McDonald’s restaurants. Using open map data combined with restaurant locations, they identified unofficial footpaths created by people instinctively choosing the quickest route. Then they photographed those paths exactly as they exist and turned them into billboards.

No invented imagery. No constructed scenarios. No added design. Just documentation of what already exists: physical evidence of how people move toward McDonald’s without thinking about it. The campaign ran across Almelo, Eindhoven, Venray, Woerden, and Lemmer — each execution showing a real path that real people created through repeated use.

Executive Creative Director Erik Falke described it as “almost the opposite of our usual process. These shortcuts already existed across the country. Our job was simply to find and document them.”

Why This Campaign Works

The password campaign succeeds because it operates on three levels simultaneously:

1. Public Service It addresses a real problem. Weak passwords are a genuine security risk, and seeing your favorite menu item called out as a compromised password is more effective than any technical warning. The specificity matters seeing “110,922 people” makes it concrete rather than abstract.

2. Brand Positioning It positions McDonald’s as self-aware, helpful, and culturally engaged beyond just selling food. They’re not a cybersecurity company, but their menu recognition gives them authority to deliver a message that security companies struggle to make stick.

3. Cultural Commentary It reveals something about how brands function in our lives. The fact that thousands of people use “bigmac” as a password isn’t just a security issue it’s evidence of how certain products become emotional anchors. The campaign makes people think about their relationship with brands in a way that pure advertising never could.

The Shift in Brand Strategy

What McDonald’s Netherlands and TBWA\NEBOKO have figured out represents a broader shift in how brands use their equity. Traditional advertising asks: “How do we get people to think about our product?” This campaign asks: “What can we do with the fact that people already think about our product?”

The difference is subtle but significant. One approach treats brand recognition as something to build. The other treats it as infrastructure you can use for purposes beyond selling.

This is particularly effective in markets where brand saturation is high. McDonald’s doesn’t need more awareness in the Netherlands. Everyone knows what a Big Mac is. The challenge isn’t getting noticed it’s finding new ways to demonstrate relevance and cultural understanding.

By using their menu items to solve a problem that has nothing to do with food, they’re showing that they understand how deeply embedded they are in people’s lives including in ways that might not be helpful. That level of self-awareness is rare in brand communication.

The Execution Details That Matter

Several elements made this campaign work that could have easily been overlooked:

Timing: February 1st is Change Your Password Day, a date most people don’t know exists. By hijacking it, McDonald’s turned an ignored awareness day into something you can’t miss when it’s staring at you from a 6-foot screen while you wait for your train.

Location: Subway stations are perfect for this type of intervention. You’re stuck waiting, phone in hand, with nothing to do but read what’s in front of you. You can’t scroll past. You can’t close the tab. You have to engage with it, even if only for the 30 seconds until your train arrives.

Format: Digital out-of-home screens that mimic login interfaces. The password fields looked exactly like what you see when you’re typing in credentials. That familiarity makes the message hit harder — you recognize the context immediately.

Copy: “You’re lovin’ it. But hackers too.” Five words that twist McDonald’s global slogan into a warning. The familiarity of the phrase makes the subversion work. You know the original, so you notice the change.

Source Citation: The data came from Have I Been Pwned, a credible source that security professionals actually use. This wasn’t invented for the campaign it was real intelligence about real security failures. That credibility matters.

The Broader Context: TBWA\NEBOKO’s Creative Philosophy

Looking at the pattern of campaigns TBWA\NEBOKO has created for McDonald’s Netherlands, a clear philosophy emerges: trust your brand assets to work harder than you think they can.

The scent billboards trusted smell alone. The shortcut campaign trusted physical behavior patterns. The password campaign trusted menu item names. Each one strips away traditional advertising elements and asks: “What’s the minimum we need to communicate McDonald’s?”

This approach only works when you have brand salience so strong that people fill in the gaps automatically. But when you do have that level of recognition, the minimalist approach creates surprise. You expect to see a full McDonald’s ad. Instead, you see just enough to trigger recognition and that gap between expectation and execution creates attention.

Chief Creative Officer Darre van Dijk, who has been leading TBWA\NEBOKO’s work, has described this as “finding what already exists rather than inventing something new.” The shortcuts campaign exemplifies this — they didn’t create paths to McDonald’s, they documented paths that customers had already created through repeated use.

It’s a philosophy that works particularly well in dense, saturated advertising environments like the Netherlands, where traditional attention-grabbing tactics are less effective because everyone is using them.

What Other Brands Can Learn

The password campaign offers several insights for brands thinking about how to use their equity:

1. Your brand assets extend beyond what you control McDonald’s doesn’t own the fact that people use “bigmac” as passwords. But they can acknowledge it, comment on it, and use it strategically. Your brand exists in people’s lives in ways you might not be tracking — some of those uses could become campaign material.

2. Self-awareness is a positioning tool Acknowledging that your product is so embedded in culture that it’s showing up in weak passwords is a flex disguised as humility. It says: “We’re so present in your life that you’re using us wrong.” That’s a confidence that most brands don’t have.

3. Category boundaries are artificial McDonald’s isn’t a cybersecurity company. They don’t need to be. Their menu recognition gives them a platform to deliver messages that transcend their category. If your brand has strong salience, you can operate in adjacent spaces where that recognition adds credibility.

4. Public service can be brand strategy Helping people improve their password security doesn’t directly sell burgers. But it positions McDonald’s as a brand that understands how they exist in people’s lives and cares enough to help solve problems even problems they inadvertently contributed to. That goodwill has value.

5. Minimalism works when you can trust your assets You can only strip away elements if what remains is powerful enough to carry the message. McDonald’s can show just a product name because that name triggers instant recognition. Most brands can’t do this which is exactly why it works when you can.

The Limitations

It’s worth noting that this strategy has constraints. It works for McDonald’s Netherlands because:

• They have decades of brand building creating strong memory structures
• Their market penetration is near-universal everyone knows the menu
• They’re working in a small, culturally cohesive market where shared references work
• TBWA\NEBOKO has built trust to experiment with unconventional approaches
• The campaigns are limited in scope (one day, specific locations) so failures wouldn’t be catastrophic

A newer brand couldn’t execute this. A global campaign would lose the cultural specificity that makes it work and even for McDonald’s, this type of minimalist intervention only works because it sits alongside more traditional advertising that maintains baseline awareness.

The Future of Brand Equity Usage

The password campaign points toward a future where brands use their salience as infrastructure for delivering messages beyond product marketing. As attention becomes more expensive and traditional advertising becomes less effective, brands with strong cultural presence will look for ways to leverage that presence for purposes beyond selling.

We’re already seeing versions of this: Nike using their platform for social justice messaging, Patagonia using their brand to advocate for environmental causes, Ben & Jerry’s taking political stances that their ice cream has nothing to do with. These brands have figured out that cultural capital can be spent on things beyond product promotion.

McDonald’s Netherlands is doing something slightly different they’re using their menu recognition to solve a problem their brand inadvertently contributed to. It’s brand equity used for behavior change rather than purchase behavior. And it works because the recognition is already there, embedded so deep that menu items function as cultural shorthand.

Conclusion

The password campaign succeeds because it does something rare: it acknowledges reality rather than trying to shape it. McDonald’s products are so embedded in people’s lives that they show up in passwords. That’s not something the brand created intentionally, but it is something they can comment on, leverage, and use to provide value.

110,922 people using “bigmac” as a password isn’t a marketing win — it’s evidence of cultural penetration so deep that it creates security vulnerabilities. By pointing this out, McDonald’s Netherlands demonstrates self-awareness and cultural intelligence that goes beyond typical brand communication.

The bigger insight here: brands with strong salience don’t need to create relevance they need to find ways to acknowledge the relevance they already have. The password campaign doesn’t convince anyone that McDonald’s matters. It shows that McDonald’s matters so much that it’s showing up in ways the brand never intended.

That’s not advertising. That’s cultural infrastructure being used for public good. And it only works because the brand is already inside people’s heads, forming the building blocks of their daily digital security failures.

The question for other brands: What’s your equivalent of “bigmac” as a password? What evidence exists in the world that your brand has penetrated deeper than you realized? And once you find it, what can you do with that reality besides trying to sell more product?

McDonald’s Netherlands found their answer. The rest is waiting to be discovered.

Key Takeaways

• Brand salience can be weaponized for behavior change outside your category
• Self awareness is a positioning tool when used strategically
• Minimalist campaigns work when your brand assets are strong enough to carry meaning alone
• Public service can be brand strategy when it acknowledges how your brand exists in people’s lives
• Cultural penetration creates opportunities beyond traditional advertising

Campaign Credits

Client: McDonald’s Netherlands

Agency: TBWA\NEBOKO

Chief Creative Officer: Darre van Dijk

CMO: Stijn Mentrop Huliselan (former), Els Dijkhuizen (current)

Launch Date: February 1, 2026

Locations: Amsterdam and Utrecht subway stations

Data Source: Have I Been Pwne