Applebee’s Fixes Security Flaw Exposing Customer Data via Hardcoded Database Password

Image: TechCrunch · Source

A security researcher discovered Applebee’s app contained a hardcoded database password, exposing personal customer information. The company has since addressed the vulnerability to secure its data.

Applebee’s restaurant chain recently resolved a critical security vulnerability that exposed personal information of its registered customers. The flaw, uncovered by UK-based cybersecurity researcher Robert Wiggins, stemmed from a hardcoded password embedded within Applebee’s Android mobile app source code. This credential granted unrestricted access to an internal customer database.

Wiggins identified the password through AI-assisted analysis while examining thousands of lines of code in the app, which has over a million downloads on Google Play. Hardcoding such credentials is a severe security lapse because anyone with access to the app can extract the key and gain unauthorized entry to backend systems.

Verification by TechCrunch confirmed Wiggins’ findings: by creating a dummy Applebee’s account, they accessed sensitive customer data including names, email addresses (with verification status), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses linked to recent logins. The exposure also risked potential unauthorized modification of customer records.

Wiggins attempted to notify Applebee’s and its parent company, Dine Brands, but no dedicated security reporting channels were available, so TechCrunch assisted in disclosure. In response, Dine Brands acknowledged the issue, stating their security team launched an investigation and had yet to find evidence of unauthorized access. However, they declined to detail server log capabilities or how long the vulnerability persisted.

It remains unclear how many customers were affected; last year, Applebee’s rewards program had at least 8.5 million enrolled members, though the exact scope of the data exposure is unknown. The company also has not confirmed whether it will notify affected customers or regulators, nor if it intends to file mandatory breach disclosures with U.S. authorities.

This incident underscores the risks of embedding sensitive credentials directly in app code, particularly for widely used consumer applications. Applebee’s prompt fix demonstrates the importance of swift response, but the lack of transparent communication raises questions about ongoing security monitoring and customer protection practices at major restaurant chains.