Applebee's closes customer data leak: database password was stored right in the app

A password hidden in the app's code

The Applebee's restaurant chain has fixed a vulnerability that allowed anyone to access the personal data of registered customers. The cause was a password for an internal database left directly in the code of the mobile app — as reported by TechCrunch, which delayed publication until the fix was confirmed. The vulnerability was discovered in early October by British cybersecurity researcher Robert Wiggins of What Security, known for previous findings of exposed data. He used AI to search for credentials among thousands of lines of source code.

What was accessible and how it was verified

This technique — hardcoding a password into software — is considered one of the most serious vulnerabilities: anyone who downloaded the app can extract the key and log into the remote system as an authorized user. Wiggins noted that the credentials would have allowed an attacker not only to read but also to modify records in the database. The TechCrunch editorial team verified the finding themselves: they decompiled the Applebee's Android app (more than a million downloads on Google Play), confirmed the password was present, and created a test account whose data Wiggins then extracted from the company's database. The database stored names, email addresses (with a verification flag), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses of the most recent logins, from which a person's approximate location could be determined.

The company's response and open questions

There was no one to report the problem to directly: neither Applebee's nor its parent company Dine Brands provided a channel for vulnerability reports, so Wiggins turned to TechCrunch for help. An unnamed Dine Brands spokesperson stated in an email that the security team had 'found no evidence of unauthorized access at this time,' but declined to answer whether server logs were available for verification. The scale of the problem is also unclear: according to the trade publication Customer Experience Dive, Applebee's loyalty program had at least 8.5 million customers as of last year, but the company did not say exactly how many records were affected by the leak. TechCrunch also asked whether the company would notify customers and US regulators, including filing disclosures with the SEC (mandatory for public companies in the event of significant incidents), and how long the password had been in the app — no response followed.