Applebee’s Data Exposure: Hardcoded App Password Put Customer Information at Risk

Applebee’s fixed a security flaw that allowed access to registered customers’ personal information after a researcher found a password for an internal database inside the Applebee’s mobile app, TechCrunch reported. The issue involved a hardcoded credential in the Android app, a severe security weakness because anyone with the app could potentially extract the key and use it to access a remote system.

TechCrunch said it withheld publication until the bug was confirmed fixed. Applebee’s confirmed it had taken action to address the issue and prevent unauthorized access to its customer database.

The exposed database contained names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, account creation dates, login counts, and recent login IP addresses, according to TechCrunch. The report says IP addresses can be used to reveal a person’s approximate location.

The researcher said the credential could also have allowed a malicious attacker to modify customer data. TechCrunch said it verified the findings by examining the app’s source code and using a dummy Applebee’s account to confirm that account data could be retrieved.

Dine Brands, Applebee’s parent company, said its security team launched an investigation and had not currently found evidence of unauthorized access, according to an emailed statement cited by TechCrunch. The company added that its investigation was ongoing and that it would take appropriate steps based on its findings.

Key details remain unclear, including how many customers were affected, how long the credential was present in the app, whether server logs can confirm access activity, and whether customers or U.S. regulators will be notified.

This was a data exposure, not a confirmed unauthorized breach based on the information provided. Still, the exposed fields could be useful for scams, account targeting, or location inference, especially when combined with other personal information.

Customers who registered with Applebee’s should watch for updates from Applebee’s or Dine Brands and be cautious with unsolicited messages that reference account details. The broader takeaway for app makers is clear: sensitive credentials should not be stored inside publicly distributed apps.