Applebee’s patched a security flaw after a researcher found a database password embedded inside the chain’s Android app, a lapse that allowed access to customers’ personal information. TechCrunch held the story until the issue was confirmed fixed. The exposed credential, discovered in the app’s source code, could be extracted by anyone with the app and used to access the company’s customer database.
Discovery and verification
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the credential earlier this month. Wiggins used AI to help find the hardcoded password buried in thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play. TechCrunch verified Wiggins’ findings by downloading and decompiling the app to examine its source code. To confirm access, TechCrunch created an Applebee’s account with dummy data and Wiggins was able to retrieve that information from the company’s database.
What data was exposed
The exposed database included customer names, email addresses (including whether a customer had verified their email), dates of birth, phone numbers, and ZIP codes. Additional fields accessible in the database included veteran status, the number of times customers had logged in, account creation dates, and the IP addresses of customers’ most recent log-ins — which can reveal approximate location. Wiggins noted that the hardcoded credential could have allowed a malicious actor not only to read data but also to modify customer records.
Company response and investigation
Wiggins said he was unable to alert Applebee’s or its parent, Dine Brands, directly because neither company provided a method for reporting security issues; he asked TechCrunch for help disclosing the flaw. A Dine Brands spokesperson thanked TechCrunch and the researcher for bringing the issue to their attention, said the company’s security team promptly launched an investigation, and added that it had “not currently found any evidence of unauthorized access.” The spokesperson would not say whether the company maintains server logs that could be reviewed to determine if anyone accessed the database, nor would they specify how long the credential had been present in the app. The company said its investigation is ongoing and that it will take appropriate steps based on findings.
Scope and outstanding questions
It remains unclear how many customers were affected by the exposure. Wiggins told TechCrunch that determining the number of customers in the database would have required the AI model to access potentially every customer record, which he avoided. Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, though Dine Brands did not provide a count of how many customers’ personal information may have been exposed. TechCrunch also asked whether the company would alert customers or U.S. regulators, including filing a disclosure with the U.S. Securities and Exchange Commission, but did not receive a response.
The severity of the issue
Storing a password or private key in software — known as hardcoding credentials — is widely recognized as a severe security vulnerability because anyone with the app can extract the key and use it to log in to remote systems as if they were an authorized user. In this case, the exposed credential not only allowed viewing sensitive customer fields but also could have permitted modification of database records.
Licensed under CC BY-ND 4.0 International