Applebee's closes flaw that exposed registered customers' personal data
Anyone with the embedded database password could have read, and possibly altered, records for millions of rewards members.
Restaurant chain Applebee's has closed a flaw that let anyone reach its registered customers' personal records, after a researcher located a database password embedded in the company's Android app. The researcher, Robert Wiggins of What Security, used AI tooling to dig the credential out of the app's source code, and it granted access to the customer database, where he could also have altered records. TechCrunch confirmed the problem by decompiling the app and logging in with a dummy account, then held publication until the fix was in place. Exposed fields included names, emails, birth dates, phone numbers, ZIP codes, veteran status, login counts and IP addresses that could reveal approximate location. Parent company Dine Brands says it has found no evidence of unauthorized access and is still investigating, though it would not say whether server logs exist to confirm that.
Why it matters
The incident shows how a credential left inside a widely downloaded mobile app can expose personal data at scale. Registered customers of the chain, which had at least 8.5 million rewards members as of last year, are the people most directly affected, since names, emails, birth dates, phone numbers and IP addresses were visible to anyone who found the password. Dine Brands says it has seen no sign of unauthorized access, but it has not confirmed whether server logs exist to check that. Until that investigation is complete, the full reach of the exposure remains unknown.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.