Applebee’s has fixed a security flaw in its Android app that left a password for an internal customer database embedded in the app’s code, potentially allowing anyone who extracted the credential to access registered customers’ personal information. TechCrunch reported the issue after independently verifying that the exposed credential worked.
U.K.-based security researcher Robert Wiggins of What Security discovered the password earlier this month. He used an AI tool to help locate it among thousands of lines of source code in Applebee’s Android app, which has more than one million downloads. TechCrunch said it decompiled the app and tested the finding with a dummy account, confirming that the credential could retrieve customer data from the database.
The exposed records included names, email addresses and email-verification status, dates of birth, phone numbers, ZIP codes, veteran status, account creation dates, login counts and recent login IP addresses. IP addresses can reveal a person’s approximate location. Wiggins said the credential could also have allowed an attacker to modify customer records.
Applebee’s parent company, Dine Brands, said its security team investigated and had not found evidence of unauthorized access so far. The company said the investigation was continuing, but it did not disclose how many customers’ records were exposed, how long the credential had been present in the app or whether server logs could establish if anyone accessed the database. TechCrunch said it held publication until the company confirmed the flaw had been fixed.
The exposure is not proof that criminals accessed the database, but it left customer information reachable through a credential distributed in a public app. Hardcoded secrets are especially risky because mobile app code can be extracted and inspected. Credentials that protect internal systems should be kept server-side and revoked or rotated when exposed.
Other recent incidents have also put customer records at risk. Chainalysis disclosed access to customer names and email addresses, while Sony Network Communications reported a breach affecting millions of records. A separate Amadeus-related exposure affected ANA passenger information.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
What users should do
Applebee’s customers should be alert for unexpected emails, texts or calls that mention personal details and claim to offer account help, rewards or refunds. Open the Applebee’s app or website directly rather than following links in unsolicited messages, and check the account for unfamiliar activity. If you receive a notice about the incident, verify it through Applebee’s official customer-support channel. The company has not said how many accounts were affected or whether it will contact customers individually.
