McDonald's Soft-Serve Machines Kept Their Diagnostics Behind a Passcode Left Out of Every Owner's Manual. When a Startup Sold Franchisees a Device That Read Them, McDonald's Warned It Could Cause Serious Human Injury.
The soft-serve machine in most of McDonald's 13,000-plus American restaurants is the Taylor C602, which Taylor sells to franchisees for about $18,000. Rather than being emptied and cleaned every day, it runs a nightly "heat treatment" that raises its contents to 151 degrees Fahrenheit, holds them for at least 30 minutes and refreezes them. The whole cycle takes four hours. Leave a little too much mix in a hopper, or unplug the machine at the wrong moment, and the cycle fails with an inscrutable error, and the machine is out until the four hours run again.
The technician has an advantage over the owner. As Andy Greenberg reported in Wired in April 2021, the machine's vital signs, from mix viscosity to glycol temperature to what its error codes actually mean, sit in a service menu that appears in no owner's manual. To reach it, an operator presses the cone icon, then uses the snowflake and milkshake buttons to set the display to 5, 2, 3, 1, which comes to at least sixteen button presses. Taylor's approved distributors charge franchisees thousands of dollars a year for maintenance contracts, with technicians on call to come and enter the code. According to a document published when the Middleby Corporation bought Taylor in 2018, repair and maintenance contracts made up close to a quarter of Taylor's revenue.
The Code
Jeremy O'Sullivan and Melissa Nelson, two former accountants, found the code by accident. Their first startup, Frobot, built a self-service frozen-yogurt kiosk around a Taylor machine, and sanitation rules required them to monitor the product's temperature. The data was locked inside the machine. The technician they called out could pull it up at once by typing 5-2-3-1. O'Sullivan spent four months at the Hax hardware accelerator in Shenzhen building a device to intercept the machine's internal communications. When he asked Taylor for technical help, an executive wrote back that "if you want to tap into the controls or sniff data packets it will need to be without the assistance of Taylor at this time due to our current security policies."
The Frobots kept breaking for the same reasons McDonald's machines did, so in April 2019 the couple relaunched as Kytch, selling only the eavesdropping box. It was a Raspberry Pi computer, about the size of a paperback, that sat inside the machine, logged the hidden data, bypassed the passcode and sent alerts to a phone, for $10 a month after a six-month free trial. A feature called Kytch Assist adjusted the hidden settings to head off common failures before they happened. One franchisee whose machine had been failing almost weekly learned almost at once that an employee was overfilling a hopper. By autumn 2020 more than 500 devices were installed, and sales were doubling every quarter.
The Field Brief
Taylor had noticed. Within two days of Kytch's launch a Taylor executive placed an order, which the founders cancelled; another came from Taylor's outside law firm. Taylor emails later disclosed in litigation showed its vice-president of engineering, Jim Minard, asking a colleague in May 2019 to "please buy a [Kytch] kit and provide me a written evaluation on the hardware and software," adding: "Seems we might be missing something in our approach to our connected equipment." In February 2020 Taylor's president, Jeremy Dobrowolski, wrote that "McDonald's is all hot and heavy about this." On 17 October 2020 Middleby's chief executive, Timothy FitzGerald, wrote: "Not sure if there is anything we can do to slow up the franchise community on the other solution. Not sure what communication from either McD or Midd can or will go out."
On 2 November 2020 McDonald's emailed its franchisees. Kytch, it said, voided the machines' warranties and "allows complete access to all aspects of the equipment's controller and confidential data", and "creates a potential very serious safety risk for the crew or technician attempting to clean or repair the machine." It could cause "serious human injury." In bold italics: "McDonald's strongly recommends that you remove the Kytch device from all machines and discontinue use." Before sending it, McDonald's had shared a draft with Taylor. "I am a bit in shock they are willing to take such a strong position," a Taylor executive, Scott Nicholas, wrote to colleagues. The next day McDonald's announced a Taylor product that did much of what Kytch did, called Taylor Shake Sundae Connectivity.
Franchisees cancelled hundreds of subscriptions. The franchisees who spoke to Wired called the injury claim far-fetched. Taylor's own manual said to unplug the machine before servicing it, Kytch's later complaint noted that removing the freezer door disabled the motor, and the devices had been certified to Underwriters Laboratories safety standards. McDonald's said the concern was remote operation, because someone cleaning a machine "could potentially be injured if the equipment is turned on remotely." Taylor said that it "has not imitated Kytch's device and would have no desire to do so." Not every franchisee took Kytch's side. One prominent operator, posting as McD Truth and later McFranchisee, blamed the startup's collapse on its own reliability problems and rising prices.
The Inquiry
By then the machines had public scrutiny of their own. In October 2020 Rashiq Zahid, a 24-year-old software engineer in Berlin, reverse-engineered the McDonald's app to put ice cream in a basket at every US restaurant and record which ones could not take the order. He published the results as McBroken.com. In its first week it showed about 9.3 percent of machines down nationwide. In summer 2021, according to The Wall Street Journal, the Federal Trade Commission wrote to McDonald's franchisees asking why the machines broke and whether owners were allowed to fix them. McDonald's said it had no reason to believe it was the focus of an investigation.
Kytch sued Taylor, its distributor TFG and a franchisee in California state court in May 2021, and in July won a temporary restraining order requiring Taylor to hand over the Kytch devices it held. On 1 March 2022 it sued McDonald's in Delaware for $900 million, the figure the founders said the company would have been worth if it had not been sabotaged. The complaint said Taylor made $75 million a year from its "repair racket" at McDonald's. McDonald's called the claims "meritless." By December 2023, more than two years after it was due, Taylor Shake Sundae Connectivity had still not reached restaurants. McBroken was showing between 13 and 17 percent of machines down.
The Exemption
The ice cream machine made it into federal regulation. iFixit and Public Knowledge asked the Copyright Office for an exemption from the anti-circumvention rule in Section 1201 of the Digital Millennium Copyright Act, and the FTC and the Justice Department's Antitrust Division filed comments supporting them. On 28 October 2024 a rule took effect allowing circumvention of software locks on equipment "primarily designed for use in retail-level commercial food preparation when circumvention is a necessary step to allow the diagnosis, maintenance, or repair of such a device." The Copyright Office acknowledged that the problem was "so widespread that it has become a news story in its own right." It also cited a lawsuit, one that "involves the commercial distribution of a circumvention tool in violation of the DMCA anti-trafficking provisions."
The exemption covers owners who break the lock themselves. It does not cover anyone who sells them the means to do it. "It is still a crime for iFixit to sell a tool to fix ice cream machines," said Kyle Wiens, iFixit's chief executive, "and that's a real shame."
The Dismissal
The lawsuits ended out of view. In March 2024 Taylor asked the Third Circuit to pause Kytch's appeal "pending completion of settlement agreement." The McDonald's case had moved to the federal court in San Francisco. Kytch's former law firm, Clare Locke, claimed at least $7 million in fees, and an arbitrator froze funds from what Bloomberg Law called a "potential multimillion-dollar settlement with McDonald's." On 21 April 2025 the firm released its lien. On 8 May 2025 Kytch and McDonald's filed a joint stipulation to dismiss the case with prejudice, and Taylor filed one to dismiss the appeal. No terms have been made public.
Since October 2024 any franchisee may legally break into the service menu of the machine on their own counter, provided nobody sells them the means to do it. The one company that did has dismissed its claims with prejudice, on terms nobody has disclosed.
Filed from public reporting:
- Wired — "They Hacked McDonald's Ice Cream Machines—and Started a Cold War"
- Wired — "The McDonald's Ice Cream Machine Hacking Saga Has a New Twist"
- Wired — "Ice Cream Machine Hackers Sue McDonald's for $900 Million"
- Wired — "McDonald's Ice Cream Machine Hackers Say They Found the 'Smoking Gun' That Killed Their Startup"
- Nation's Restaurant News — "The FTC is investigating McDonald's constantly broken McFlurry machines"
- FOX 11 Los Angeles — "'McBroken': McDonald's fan launches site that identifies restaurants with broken ice cream machines"
- Federal Register — "Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies"
- 404 Media — "It Is Now Legal to Hack McFlurry Machines (and Medical Devices) to Fix Them"
