EN PT-BR
← Voltar ao feed
medium hospitality food_service

Applebee's app exposed customer database via hardcoded credential, leaking personal data of registered users

1 fonte(s) · 1 atualização(ões) · publicado 30/10/2026 18:48 · coletado há 2 dias

Applebee's fixed a flaw that let anyone access personal data of registered customers after researcher Robert Wiggins (What Security) found a hardcoded database credential in the chain's Android app, which has over a million downloads on Google Play. TechCrunch verified the finding by decompiling the app and retrieving data for a dummy account it created. Parent company Dine Brands said it found no evidence of unauthorized access so far, but would not say whether it keeps server logs that could confirm this. The number of affected customers is unknown; the rewards program had at least 8.5 million enrolled members as of last year.

Detalhes técnicos

  • Wiggins used AI to locate the credential among thousands of lines of source code in the Applebee's Android app.
  • The credential gave access to the customer database and could also have allowed modification of customer data.
  • Exposed fields: names, email addresses (and email verification status), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and IP addresses of most recent logins (which can reveal approximate location).
  • Neither Applebee's nor Dine Brands offers a way to report security issues, so the disclosure went through TechCrunch.
  • It is unknown how long the credential was in the app. Dine Brands did not say whether it would notify customers, regulators or the SEC.

Remediação

  • Applebee's confirmed on Thursday that it had taken action to prevent unauthorized access to the database; the investigation is ongoing.
  • Remove hardcoded credentials from mobile apps, rotate exposed secrets, review database access logs, and publish a vulnerability disclosure channel.

Linha do tempo

  1. techcrunch.com ↗ · pub. 30/10/2026 18:48 · coletado 30/10 19:00 primeiro registro

    Applebee's app exposed customer database via hardcoded credential, leaking personal data of registered users

    ler a análise desta fonte

    Applebee's fixed a flaw that let anyone access personal data of registered customers after researcher Robert Wiggins (What Security) found a hardcoded database credential in the chain's Android app, which has over a million downloads on Google Play. TechCrunch verified the finding by decompiling the app and retrieving data for a dummy account it created. Parent company Dine Brands said it found no evidence of unauthorized access so far, but would not say whether it keeps server logs that could confirm this. The number of affected customers is unknown; the rewards program had at least 8.5 million enrolled members as of last year.

    Technical Details

    • Wiggins used AI to locate the credential among thousands of lines of source code in the Applebee's Android app.
    • The credential gave access to the customer database and could also have allowed modification of customer data.
    • Exposed fields: names, email addresses (and email verification status), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and IP addresses of most recent logins (which can reveal approximate location).
    • Neither Applebee's nor Dine Brands offers a way to report security issues, so the disclosure went through TechCrunch.
    • It is unknown how long the credential was in the app. Dine Brands did not say whether it would notify customers, regulators or the SEC.

    Remediation

    • Applebee's confirmed on Thursday that it had taken action to prevent unauthorized access to the database; the investigation is ongoing.
    • Remove hardcoded credentials from mobile apps, rotate exposed secrets, review database access logs, and publish a vulnerability disclosure channel.