Applebee's Left Database Password Inside Its Android App

A password buried in Applebee's Android app let anyone access the restaurant chain's customer database, and the flaw sat there until a U.K. researcher found it earlier this month. Applebee's confirmed on Thursday that it had fixed the issue, according to TechCrunch, which withheld publication until the bug was verified as patched.

Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, made the discovery. He used AI to locate the credential hidden inside thousands of lines of source code in the app, which has more than a million downloads on Google Play. Wiggins has a track record of finding exposed or sensitive information that should not be publicly accessible.

Why a hardcoded password matters

Storing a password or private key inside software — what security professionals call hardcoding credentials — ranks among the most severe types of vulnerabilities. Anyone with the app can extract the key and use it to log in to a remote system as if they were an authorized user. Wiggins said the hardcoded credential could also have let a malicious attacker modify customer data in the database.

TechCrunch verified the findings independently. Reporters downloaded and decompiled the Android app, examined the source code and confirmed it contained the exposed credential. They then created an Applebee's account with dummy data, which allowed Wiggins to retrieve that information from the company's database.

What data was exposed?

The database held a wide set of personal fields:

• Customer names and email addresses, including verification status
• Dates of birth, phone numbers and ZIP codes
• Veteran status
• Login counts, account creation dates and IP addresses of recent logins — data that can reveal a person's approximate location

Nobody knows how many customers were affected. Wiggins said counting records would have required the AI model to unnecessarily access potentially every customer entry. Applebee's had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not say how many had their information exposed by this flaw.

How the disclosure actually happened

Wiggins couldn't alert Applebee's or its parent company, Dine Brands, directly — neither offers a way to report security issues. He asked TechCrunch to help disclose the problem to the company.

A Dine Brands spokesperson, who declined to provide a name, said in an emailed statement on Friday: "We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access."

Pressed by TechCrunch, the spokesperson would not say whether the company has server logs it can review to determine whether anyone accessed the database — or whether it keeps any logs at all. "Our investigation is ongoing, and we will take appropriate steps based on our findings," the company added.

Will customers or regulators be told?

TechCrunch asked whether Applebee's would alert customers or U.S. regulators, including whether it would file a disclosure with the Securities and Exchange Commission — a requirement for publicly traded companies reporting material cybersecurity incidents. The company also didn't answer a question about how long the exposed credential had been sitting in the app. There was no response.

TechCrunch says it will update its reporting if the company responds. For Dine Brands, the unanswered questions about logs, notification obligations and how long the credential was live now carry legal weight, since SEC disclosure rules for material incidents leave little room for silence.