Applebee’s has fixed a security flaw that exposed personal information belonging to registered customers after a researcher found a database password hidden inside the company’s mobile app, according to reporting confirmed by the restaurant chain. The issue highlights how a single hardcoded credential in public-facing software can open the door to sensitive customer records, and in this case it appears to have left Applebee’s database accessible to anyone who found the embedded login details.
How the Applebee’s database exposure was discovered
The flaw was uncovered earlier this month by Robert Wiggins, a U.K.-based cybersecurity researcher at What Security. Wiggins found the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play.
According to the reporting, he used AI to help identify the password hidden in the app code. That password granted access to an internal customer database, creating a path for anyone who extracted it to connect to the remote system as if they were an authorized user.
TechCrunch said it verified Wiggins’ findings by downloading and decompiling the Android app to inspect the source code and confirm the exposed credential. The outlet also created an Applebee’s account using dummy information, which then allowed Wiggins to retrieve that data from the company’s database.
Why a hardcoded password is so dangerous
Storing a password or private key directly in software is known as hardcoding credentials, and it is widely regarded as one of the most serious security mistakes a developer can make. Once the app is released, anyone with access to it may be able to extract the secret and use it to access systems behind the scenes.
In this case, the security lapse did not just expose a login mechanism. Wiggins said the credential could also have allowed a malicious attacker to modify customer data in the database, not merely view it. That raises the stakes beyond a privacy issue and into the realm of potential data tampering.
What customer information was exposed
The exposed database contained a range of personal details tied to registered Applebee’s customers. Based on the findings reported by TechCrunch, the data included:
- Customer names
- Email addresses, including whether the email had been verified
- Dates of birth
- Phone numbers
- ZIP codes
- Veteran status
- The number of times customers had logged in
- Account creation dates
- IP addresses from the most recent log-ins
IP addresses can sometimes be used to estimate a person’s approximate location, making them particularly sensitive when paired with names, contact information, and account history. The inclusion of veteran status also makes the exposure more notable, since that is a personal attribute many customers would not expect to be associated with a public-facing application or customer database.
It is not known exactly how many customers were affected. Wiggins said determining the total would have required the AI model to access potentially every customer record, which he said was unnecessary for confirming the issue. Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, but the company would not say how many of those customers had personal information exposed in this incident.
Applebee’s response and the fix
Applebee’s confirmed on Thursday that it had taken action to address the security issue and prevent unauthorized access to its customer database. TechCrunch withheld publication of the story until the flaw was fixed.
A spokesperson for Dine Brands, the parent company of Applebee’s, said in an emailed statement on Friday: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.”
When asked whether the company had server logs that could show if anyone accessed the database, or whether it had logs at all, the spokesperson declined to answer. “Our investigation is ongoing, and we will take appropriate steps based on our findings,” the company added.
TechCrunch also asked whether Applebee’s would notify customers or U.S. regulators about the incident, including whether it would file a disclosure with the U.S. Securities and Exchange Commission if the event were deemed material. The company did not respond to those questions, nor did it say how long the exposed credential had been inside the app.
Disclosure challenges around the incident
One unusual aspect of the case is that Wiggins was unable to alert Applebee’s or Dine Brands directly because neither company appeared to offer a clear way to report security issues. He ultimately asked TechCrunch to help disclose the problem.
That gap matters because a bug bounty program or a dedicated security contact can shorten the time between discovery and remediation. Without a public reporting channel, a researcher may have to rely on indirect escalation, which can delay fixes and make responsible disclosure more difficult.
For Applebee’s, the swift remediation is important, but questions remain about whether anyone else discovered the credential before it was removed and whether the company can determine if the exposed database was actually accessed. The spokesperson’s comments indicate the investigation is still underway, and no evidence of unauthorized access has been identified so far.
What this means for customers
For customers, the biggest concern is that a combination of identity details, account information, and login metadata may have been exposed through a flaw that should never have reached production. Even if the company has not found signs of misuse, personal data exposure can still create risk if bad actors copied the information before the fix.
The incident also serves as a reminder that mobile apps can reveal more than just the features users see on screen. If sensitive credentials are embedded in app code, attackers may be able to uncover them through reverse engineering, just as Wiggins did here.
As more companies rely on mobile apps and connected back-end systems to manage customer rewards and profiles, the security of application code becomes critical. The Applebee’s case shows how a single overlooked password can expose far more than a login screen—it can open a direct path to a live database containing personal information.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 31, 2026 at 10:33 pm
2 views
