Applebee’s App Exposed Customer Data Through a Database Password Left in Its Code

What Happened

Robert Wiggins, a UK-based security researcher at What Security, found the problem earlier in October. He used AI to search the source code of Applebee’s Android app and found a database credential written directly into it.

Anyone who extracted the credential from the app could log in to the customer database as an authorized user. According to Wiggins, it could also have been used to change customer data, not just read it.

TechCrunch verified the finding by decompiling the app and testing it with a dummy account, and held its report until the issue was fixed.

What Data Was Exposed

According to TechCrunch, the database contained:

• customers’ names and email addresses, including whether the addresses were verified;
• dates of birth and phone numbers;
• ZIP codes and veteran status;
• account creation dates and login counts;
• the IP addresses of recent logins.

Passwords and payment card details were not among the data TechCrunch listed.

What Applebee's Says

Applebee’s confirmed that it had taken action to fix the issue. Its parent company, Dine Brands, said its security team had launched an investigation and had found no evidence of unauthorized access so far.

Several questions remain open. The company wouldn’t say how many customers were affected or whether it has logs that would show who accessed the database. It didn’t respond to questions about how long the password had been in the app, or whether it plans to notify customers or regulators.

Why Passwords in Apps Are a Problem

Apps run on users’ phones, so anything built into them can be extracted. Tools that decompile Android apps are freely available, and a password stored in an app’s code is effectively public for anyone willing to look.

The way this one was found is a sign of the times: the researcher used AI to search the app’s code. The same kind of tools are available to attackers, which makes leftover passwords and keys easier to find than ever. The safer design is for an app to talk to the company’s own servers, which then access the database, so that no database password ever ships to users’ devices.

What Applebee's Customers Can Do

There’s no evidence that the data was misused, but anyone with an Applebee’s account should be careful:

• Watch for targeted phishing. A message that knows your name, date of birth or phone number can look convincing. Be wary of unexpected emails, texts or calls that mention your Applebee’s account, rewards or a “security problem.” Read more on why phishing is so common and how to protect yourself.
• Don’t click links in unexpected messages. Open the app or website yourself instead.
• Keep the app updated so you’re using the fixed version.
• Use a unique password for your Applebee’s account, as for every account, so a problem at one company can’t spread to others.

Applebee’s hasn’t said whether it will notify affected customers. We’ll update this article if the company shares more details.