TechCrunch Reports Applebee's App Exposed Customer Data Through a Hardcoded Password
A researcher found a database login sitting in the restaurant chain's Android app. Applebee's says it has fixed the problem.
According to TechCrunch, Applebee's left a password for an internal customer database inside its Android app, which has more than a million downloads on Google Play. UK-based security researcher Robert Wiggins of What Security found it earlier in October by using AI to search thousands of lines of the app's code. TechCrunch says it decompiled the app, confirmed the credential, and watched it pull back data from a test account it created.
TechCrunch lists the data that was reachable: names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and the IP address of each customer's most recent login. Wiggins said the same credential could have let someone change customer records. The number of people affected is unknown. TechCrunch notes Applebee's had at least 8.5 million customers in its rewards program as of last year.
Neither Applebee's nor its parent company, Dine Brands, had a way to report security problems, so Wiggins asked TechCrunch to help. Applebee's confirmed Thursday that it fixed the issue and blocked unauthorized access. A Dine Brands spokesperson said the company found no evidence of unauthorized access so far, and that its investigation is ongoing. The company did not say whether it keeps server logs or whether it will notify customers.
If you have an app, a website or a loyalty program, check that no passwords or keys are written into the app code, and ask your developer or vendor to confirm it in writing. Also publish an email address for security reports (a security@ address works). Applebee's had no way to be told about this problem, which delayed the fix.
Is AI recommending your business?
Our AI visibility audit checks what ChatGPT, Gemini and Google's AI say about you, and includes a 1:1 review of the results.
See the audits