Applebee’s fixes app flaw that exposed customer data

Applebee’s has fixed a security flaw that exposed customers’ personal information after a researcher discovered a database password embedded in the restaurant chain’s Android app. The researcher, Robert Wiggins, found the hardcoded credential with help from AI, which gave him access to an internal Applebee’s customer database.

The exposed data included names, email addresses and email-verification status, dates of birth, phone numbers and ZIP codes, veteran status, account-creation dates and login counts, and IP addresses from customers’ most recent logins, which could indicate approximate location. TechCrunch independently verified the findings by creating a dummy Applebee’s account and retrieving data from the database.

TechCrunch reported that Wiggins could not find a suitable way to report the issue to Applebee’s or its parent company, Dine Brands, and asked the publication to assist. Applebee’s confirmed on 29 October that the issue had been addressed. It remains unclear how many customers’ records were in the database; Dine Brands says it has not found evidence of unauthorised access, though its investigation is ongoing.

The article notes that payment card details or account passwords did not appear in the described fields, but cautions that it is still possible that the database was accessed before the fix, so customers should be vigilant for targeted scams. Practical guidance in the piece includes watching for unexpected Applebee’s-themed communications, verifying notices through trusted routes, and using independent contact details to reach the company.