Applebee's fixed a security vulnerability that exposed customer personal data after a U.K.-based cybersecurity researcher found a database password hardcoded in the restaurant chain's Android app. Robert Wiggins at What Security discovered the exposed credential buried in thousands of lines of source code within the app, which has more than one million downloads on Google Play.
The hardcoded password allowed anyone with the app to access Applebee's customer database. Wiggins used AI to locate the credential within the code. TechCrunch verified the finding by downloading and decompiling the app, then created a test account to confirm the exposed database contained names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses of recent logins.
The exposed database could have permitted a malicious attacker to modify customer records. Applebee's parent company, Dine Brands, confirmed it had taken action to address the issue. A Dine Brands spokesperson said in an emailed statement: "We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access."
Wiggins lacked a way to report the issue directly to Applebee's or Dine Brands and asked TechCrunch for help disclosing the vulnerability. The company did not provide the number of affected customers or say whether it maintains server logs to review for unauthorized access. Applebee's had at least 8.5 million customers enrolled in its rewards program as of last year. TechCrunch asked whether the company would alert customers or file a disclosure with the U.S. Securities and Exchange Commission, as publicly traded companies must do for material cybersecurity incidents, but received no response.