Applebee’s patches app flaw that exposed customer data

A hardcoded password in Applebee’s Android app exposed customer records from an internal database. The company says the flaw is fixed and the review continues.

Applebee’s has patched a security flaw that exposed personal data belonging to registered customers after a researcher found a database password hidden inside the company’s mobile app. The issue drew attention because it may have opened access to sensitive customer records through an app anyone could download. It also raised questions about how long the credential was available and whether anyone besides the researcher reached the database.

The restaurant chain said it had taken steps to close the gap. According to IT-PUB News, TechCrunch held its report until the flaw had been fixed.

A password was embedded in the Android app

The problem was discovered earlier this month by Robert Wiggins, a U.K.-based cybersecurity researcher at What Security. According to the report, he used AI to help locate a credential buried in thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play.

That credential gave access to the company’s customer database. In security terms, this is called hardcoding credentials — putting a password or private key directly into software, where someone who inspects the app can extract it. Researchers treat that as a serious weakness because it can let an outsider sign in to a remote system as though they were an authorized user.

Wiggins also said the same credential could have allowed a malicious attacker not just to view customer data, but to alter it.

The exposed records included contact and account details

TechCrunch verified the finding by downloading and decompiling the Android app to inspect its source code and confirm the exposed credential. The publication also created an Applebee’s account using dummy data and was able to retrieve that information from the company’s database.

The exposed records included customer names, email addresses, whether an email address had been verified, dates of birth, phone numbers, and ZIP codes. The database also held veteran status, the number of times customers had logged in, the dates accounts were created, and the IP addresses of recent logins.

Those IP addresses can reveal a person’s approximate location, making the exposure more sensitive than a simple contact list. Applebee’s has not said how long the credential remained in the app.

Applebee’s says it has found no evidence of misuse

Dine Brands, Applebee’s parent company, said in an emailed statement on Friday that its security team began an investigation after being alerted to the issue. The company said it has not currently found evidence of unauthorized access.

At the same time, Dine Brands did not say whether it has server logs that could show if anyone else accessed the database, or whether such logs exist at all. It said the investigation is still ongoing and that it will take appropriate steps based on what it finds.

Wiggins was unable to report the issue directly to Applebee’s or Dine Brands because neither company had a public way to submit security disclosures. He asked TechCrunch to help notify the company.

How many customers were affected is still unclear

It remains unknown how many customers were exposed by the flaw. Wiggins said determining that number would have required the AI model to access potentially every customer record, which he said would have been unnecessary.

Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, but the company did not say how many of them may have had personal information exposed in this incident.

TechCrunch also asked whether Applebee’s would notify customers or U.S. regulators, including whether it would make a disclosure to the U.S. Securities and Exchange Commission, which public companies must do for material cybersecurity incidents. The company did not respond to those questions.

For now, the company says the flaw is fixed, but the scope of the exposure is still unresolved. A single password left inside an app was enough to create a path to private customer data, and Applebee’s review is still underway.