EN PT-BR
← Voltar ao feed
medium hospitality food_service food service

Applebee's Android app hardcoded database credential exposed registered customers' personal data; fixed Oct 29

2 fonte(s) · 2 atualização(ões) · publicado 30/10/2026 18:48 · coletado há 13 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 03/11/2026 00:00; os links antigos trazem para cá.

Fontes: malwarebytes.com ↗ techcrunch.com ↗

Applebee's fixed a flaw that exposed personal data of registered customers after researcher Robert Wiggins (What Security) found a hardcoded database credential in the chain's Android app, which has over a million downloads on Google Play (techcrunch.com). TechCrunch verified the finding using a dummy account it created. Applebee's confirmed the fix on Thursday, October 29 (malwarebytes.com), and said it had acted to prevent unauthorized access; the investigation is ongoing. Parent company Dine Brands says it has found no evidence of unauthorized access so far, but would not say whether it keeps server logs that could confirm this (techcrunch.com). The number of affected customers is unknown; the rewards program had at least 8.5 million enrolled members as of last year (techcrunch.com). Dine Brands did not say whether it would notify customers, regulators or the SEC (techcrunch.com).

Detalhes técnicos

  • Root cause: a database credential hardcoded in the Android app, usable by anyone who could extract it against the backend (malwarebytes.com, techcrunch.com).
  • Wiggins used AI to locate the credential among thousands of lines of source code (techcrunch.com).
  • The credential gave access to the customer database and could also have allowed modification of customer data (techcrunch.com).
  • Exposed fields: names, email addresses and email verification status, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and IP addresses of the most recent logins, which can reveal approximate location (techcrunch.com, malwarebytes.com).
  • Payment card details and account passwords were not among the fields TechCrunch described (malwarebytes.com).
  • Neither Applebee's nor Dine Brands offers a way to report security issues, so the disclosure went through TechCrunch, which held its story until the fix was confirmed (techcrunch.com, malwarebytes.com).
  • It is unknown how long the credential was present in the app (techcrunch.com).

Remediação

  • Developers should not embed database credentials in mobile apps; rotate exposed secrets, review database access logs, and publish a vulnerability disclosure channel (techcrunch.com, malwarebytes.com).
  • Customers should watch for targeted scams: unexpected Applebee's-themed emails, texts or calls, especially those offering refunds or compensation, threatening account closure, or asking to verify payment details (malwarebytes.com).
  • Verify notices by opening the app or website directly, not through links in unexpected messages (malwarebytes.com).

Relatos divergentes

  • Verification: techcrunch.com says TechCrunch decompiled the app and retrieved data for its dummy account itself, while malwarebytes.com says Wiggins retrieved the dummy account. The accounts are not necessarily incompatible; techcrunch.com is the original reporting outlet.
  • Exposed fields: veteran status is listed only by techcrunch.com; malwarebytes.com omits it. The original reporting is the more authoritative.
  • Fix date: techcrunch.com says only "Thursday" (October 29); malwarebytes.com, the later source, gives October 29 explicitly. No real disagreement.

Linha do tempo

  1. malwarebytes.com ↗ · pub. 02/11/2026 11:22 · coletado 02/11 12:01

    Applebee's fixes hardcoded database password in Android app that exposed customer personal data

    ler a análise desta fonte

    Applebee's fixed a flaw after researcher Robert Wiggins found a hardcoded database password in the chain's Android app, with help from AI. The credential gave access to an internal customer database. TechCrunch verified the finding by creating a dummy account and having Wiggins retrieve it. Applebee's confirmed the fix on October 29. Parent company Dine Brands says it has found no evidence of unauthorized access, but its investigation is ongoing and the number of affected records is unknown.

    Technical Details

    • Root cause: a database password hardcoded in the app's code or configuration (hardcoded credential), which anyone able to extract it could use against the backend.
    • Exposed fields: names, email addresses and verification status, dates of birth, phone numbers, ZIP codes, account-creation dates, login counts, and IP addresses from the most recent logins (approximate location).
    • Payment card details and account passwords were not among the fields TechCrunch described.
    • Wiggins could not find a way to report the issue and asked TechCrunch to contact the company. TechCrunch held its story until the fix was confirmed.

    Remediation

    • Customers should watch for targeted scams: unexpected Applebee's-themed emails, texts or calls, especially those offering refunds or compensation, threatening account closure, or asking to verify payment details.
    • Verify notices by opening the app or website directly, not through links in unexpected messages.
    • Developers should not embed database credentials in mobile apps, and companies should publish a clear vulnerability disclosure channel.
  2. techcrunch.com ↗ · pub. 30/10/2026 18:48 · coletado 30/10 19:00 primeiro registro

    Applebee's app exposed customer database via hardcoded credential, leaking personal data of registered users

    ler a análise desta fonte

    Applebee's fixed a flaw that let anyone access personal data of registered customers after researcher Robert Wiggins (What Security) found a hardcoded database credential in the chain's Android app, which has over a million downloads on Google Play. TechCrunch verified the finding by decompiling the app and retrieving data for a dummy account it created. Parent company Dine Brands said it found no evidence of unauthorized access so far, but would not say whether it keeps server logs that could confirm this. The number of affected customers is unknown; the rewards program had at least 8.5 million enrolled members as of last year.

    Technical Details

    • Wiggins used AI to locate the credential among thousands of lines of source code in the Applebee's Android app.
    • The credential gave access to the customer database and could also have allowed modification of customer data.
    • Exposed fields: names, email addresses (and email verification status), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and IP addresses of most recent logins (which can reveal approximate location).
    • Neither Applebee's nor Dine Brands offers a way to report security issues, so the disclosure went through TechCrunch.
    • It is unknown how long the credential was in the app. Dine Brands did not say whether it would notify customers, regulators or the SEC.

    Remediation

    • Applebee's confirmed on Thursday that it had taken action to prevent unauthorized access to the database; the investigation is ongoing.
    • Remove hardcoded credentials from mobile apps, rotate exposed secrets, review database access logs, and publish a vulnerability disclosure channel.