Vulnerabilities · Privacy
Applebee’s exposed customer data by leaving database password in app
A researcher found Applebee’s left a database password in its Android app, exposing customer data. The company fixed the flaw but has not said how many were affected.
Ross Grant2 min read
The short version
A researcher found that Applebee’s left a database password inside its Android app. This mistake meant anyone could access customer information, including names and contact details. Applebee’s fixed the problem after being told, but it’s not clear if anyone else found or misused the data.
By the numbers
- 1 million+downloads of Applebee’s Android appTechCrunch
- 8.5 millionApplebee’s rewards programme members (last year)TechCrunch
What happened?
A security researcher found a database password hardcoded in Applebee’s Android app, exposing customer data. Applebee’s fixed the flaw after being notified. The company has not said how many customers were affected or if anyone accessed the data.
How the flaw works
A security researcher, Robert Wiggins, found a serious flaw in Applebee’s Android app. He used artificial intelligence (AI) to search through thousands of lines of code and discovered a hardcoded password. This password gave access to Applebee’s internal customer database. Hardcoding credentials like passwords in app code is a well-known security risk. Anyone who found the password could connect to the database and see or change customer information. TechCrunch confirmed the finding by decompiling the app and using a test account to access the database.
What was taken
The exposed database included customer names, email addresses (with verification status), dates of birth, phone numbers, and ZIP codes. It also stored veteran status, the number of times a customer had logged in, account creation dates, and the IP addresses from recent logins. IP addresses can reveal a person’s rough location. The ability to modify data meant an attacker could have changed customer records, not just viewed them.
Who is affected
Applebee’s has not said how many customers were affected. The Android app has over a million downloads, and the company had at least 8.5 million rewards programme members last year. However, it is unclear how many of these customers’ data was exposed. Wiggins said that checking the total number of records would have required accessing all customer data, which he did not do.
The response
Wiggins could not find a way to contact Applebee’s or its parent company, Dine Brands, to report the issue. He asked TechCrunch to help disclose the flaw. After being notified, Applebee’s fixed the problem. A Dine Brands spokesperson said their security team investigated and had not found evidence of unauthorised access so far. However, they would not confirm whether they had server logs to check for suspicious activity. The company’s investigation is ongoing. Applebee’s has not said if it will notify customers or regulators, or how long the password was exposed in the app.
What you should do
If you have an Applebee’s account, watch for unusual activity or messages. Consider changing your password, especially if you use the same one elsewhere. Be alert for phishing attempts using your personal details. Companies should avoid hardcoding credentials in apps and set up clear ways for researchers to report security issues.
Why it matters
This incident shows how a simple coding mistake can put millions of people’s personal data at risk. It also highlights the importance of secure coding and having a way for researchers to report problems.
Key points
- Applebee’s left a database password in its Android app, exposing customer data.
- The exposed data included names, emails, phone numbers, and IP addresses.
- Applebee’s fixed the flaw after a researcher reported it, but has not said how many were affected.
- There is no evidence yet of unauthorised access, but the investigation is ongoing.
- Hardcoded credentials in apps are a common and preventable security risk.
Sources
TechCrunch
Reference
