Applebee's has closed a security hole that let anyone pull the personal details of its registered customers, after a researcher discovered a password for an internal database embedded in the restaurant chain's mobile app. The company confirmed on Thursday that it had acted to block unauthorized access to the customer database, according to TechCrunch, which held the story until the fix was verified. The flaw was found earlier this month by Robert Wiggins, a U.K.-based cybersecurity researcher at What Security.
Why it matters
The incident turns on a practice known as hardcoding credentials — placing a password or private key directly inside software. TechCrunch describes it as one of the most serious kinds of security vulnerability, because anyone who downloads the app can dig the key out and use it to sign in to a remote system as though they were a legitimate user. In this case, the credential opened the door to Applebee's customer database.
Wiggins told TechCrunch that the exposed credential could also have let a malicious actor alter customer records, not just read them. That raises the stakes beyond a privacy problem: tampering with account data could affect how customers are treated by the business.
How the password was found
The credential was buried in thousands of lines of source code in Applebee's Android app, which has been downloaded more than a million times from Google Play. Wiggins used AI to help locate it among that code, according to TechCrunch.
To check the findings, TechCrunch downloaded and decompiled the Android app and examined its source code, confirming the credential was present. The outlet also set up an Applebee's account using dummy information, after which Wiggins was able to pull that account's details back out of the company's database — a direct demonstration that the access worked.
What the database held
According to TechCrunch, the exposed records included customers' names, email addresses and whether those addresses had been verified, dates of birth, phone numbers and ZIP codes. The data also covered veteran status, how many times each customer had logged in, when accounts were created, and the IP addresses of most recent logins — information that can be used to estimate where a person is located.
TechCrunch reports that it is not known how many customers were affected. Wiggins said determining the size of the database would have meant having the AI model access potentially every customer record, which he avoided. Applebee's had at least 8.5 million people signed up to its rewards program as of last year, though the company would not say how many customers' information was exposed by the flaw.
A disclosure with no clear channel
Wiggins was unable to notify Applebee's or its parent company, Dine Brands, directly because neither offers a way to report security problems, according to TechCrunch. He turned to the outlet for help in getting the issue to the company.
A Dine Brands spokesperson, who did not give a name, said in an emailed statement on Friday that the company appreciated TechCrunch and the researcher for raising the matter. The spokesperson said the security team began an investigation promptly and had so far found no evidence of unauthorized access. Asked whether the company keeps server logs that could show whether anyone reached the database — or whether it keeps such logs at all — the spokesperson declined to say. The company added that its investigation is continuing and that it will take appropriate steps based on what it finds.
TechCrunch also asked whether Applebee's would notify customers or U.S. regulators, including whether it would file a disclosure with the Securities and Exchange Commission, which publicly traded companies must do for material cybersecurity incidents. The outlet further asked how long the credential had sat in the app. It received no response to those questions.
What happens next will likely hinge on the company's investigation and on whether Applebee's decides to tell customers and regulators about the exposure.
