A database password sitting inside Applebee's Android app gave anyone who found it access to an internal customer database, security researcher Robert Wiggins discovered. The restaurant chain says it fixed the problem on October 29, according to Malwarebytes' write-up of the finding.
Wiggins says he found the password with help from AI. A password written directly into an app's code or configuration is known as a hardcoded credential: anyone who pulls the app apart can extract it and use it to log in to whatever system it protects.
Birth dates, phone numbers and veteran status
The exposed database contained:
- Names, email addresses and email verification status
- Dates of birth, phone numbers and ZIP codes
- Veteran status
- Account creation dates and login counts
- The IP address of each customer's most recent login, which can point to an approximate location
The fields described did not include payment card details or account passwords. It is unclear how many customers' records were in the database. Applebee's parent company, Dine Brands, says it has found no evidence of unauthorized access, but its investigation is ongoing.
Wiggins could not find a suitable way to report the issue directly to Applebee's or Dine Brands. That is a familiar failure: a company without a clear vulnerability disclosure channel leaves researchers who find a problem with nowhere to send it.
The same mistake keeps turning up
Hardcoded secrets keep turning up in mobile and embedded software because an app shipped to millions of phones is effectively handed to every attacker who wants to inspect it. IntelFusions has covered the same class of error recently in truck tracking devices and onboard ship software. The lesson for developers does not change: secrets belong on the server, behind authentication, never in the client.
Watch for Applebee's-themed scams
A fixed leak does not prove nobody used it first. Names, emails, phone numbers and birth dates are exactly what scammers need to make a message look personal, so US customers with an Applebee's account should treat unexpected Applebee's emails, texts or calls with suspicion, especially ones offering refunds or compensation, warning that an account will be closed, or asking you to verify payment details. Check any security notice by opening the app or visiting Applebee's website yourself rather than following a link, and contact the company through details you find independently.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.