Applebee’s customer data exposed by password left in app

Applebee’s has fixed a security flaw that exposed customers’ personal information after a researcher discovered a database password embedded in the restaurant chain’s Android app.

The researcher, Robert Wiggins, found the password with help from AI. It gave him access to an internal Applebee’s customer database. A password written directly into an app’s code or configuration is known as a hardcoded credential. Anyone who extracts it may be able to use it to access the system.

The exposed database contained:

• Names, email addresses, and email-verification status
• Dates of birth, phone numbers, and ZIP codes
• Veteran status
• Account-creation dates and login counts
• IP addresses from customers’ most recent logins, which can indicate their approximate location

TechCrunch independently checked Wiggins’ findings. It created an Applebee’s account with dummy information, which Wiggins successfully retrieved from the database.

According to TechCrunch, Wiggins could not find a suitable way to report the issue to Applebee’s or its parent company, Dine Brands, so he asked the publication to help contact them. TechCrunch held its story until the fix was confirmed. Applebee’s confirmed on October 29 that it had addressed the issue.

It’s unclear how many customers’ records were in the database. Dine Brands says it has not found evidence of unauthorized access, but its investigation is ongoing.

How to stay safe

The database fields described by TechCrunch did not include payment card details or account passwords. That does not tell us whether anyone accessed the database before the fix, so customers should watch for targeted scams.

Names, email addresses, phone numbers, and other personal details could help scammers make messages look relevant and convincing.

• Be wary of unexpected Applebee’s-themed emails, texts, or calls. Be especially skeptical of messages offering refunds or compensation, warning that your account will be closed, or asking you to “verify” payment details.
• Check security notices through a route you trust. Open the app directly or visit Applebee’s website yourself rather than following a link in an unexpected message. If necessary, contact the company using details you find independently.
• Unsure whether a message is a scam? Check it with Malwarebytes’ Scam Guard for an assessment and advice on what to do next.
• When sharing personal information, consider why the company needs it and whether you trust it to keep the information safe.

Unsure where a link goes? We’ll check it.

About the author

Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.