Applebee’s fixes hardcoded database password flaw exposing customer data

Researcher uncovers hardcoded password in Applebee’s Android app

Cybersecurity researcher Robert Wiggins, based in the U.K., discovered a hardcoded database password in Applebee’s Android app earlier this month. The flaw allowed unauthorized access to a database containing sensitive customer information, including names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses.

Wiggins used an AI tool to identify the credential, which was buried in the app’s source code. Hardcoded credentials are considered a severe security vulnerability, as they can be easily exploited by malicious actors to access or modify data.

Scale of exposure and Applebee’s response

Applebee’s Android app has over a million downloads on Google Play, though the exact number of affected customers remains unclear. The company’s parent, Dine Brands, stated it found no evidence of unauthorized access but is continuing its investigation. Neither Applebee’s nor Dine Brands had a mechanism for reporting security vulnerabilities, which delayed disclosure.

As of last year, Applebee’s had 8.5 million rewards program customers, but Dine Brands did not disclose how many accounts were exposed in this incident. The company also did not respond to questions about whether it plans to notify customers or regulators, despite U.S. Securities and Exchange Commission rules requiring public companies to disclose material cybersecurity incidents.

Verification and risks of the vulnerability

TechCrunch independently verified Wiggins’ findings by decompiling the Applebee’s Android app and confirming the presence of the exposed credential. The vulnerability could have allowed attackers to modify customer data or extract sensitive information, including IP addresses, which can reveal a user’s approximate location.

Wiggins noted that determining the total number of exposed records would have required accessing every customer record, which was beyond the scope of his research.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident highlights a critical but preventable security misstep: hardcoded credentials in consumer-facing applications. For founders and operators, it underscores the importance of secure coding practices, regular audits of app source code, and establishing clear channels for security researchers to report vulnerabilities. The lack of a reporting mechanism at Applebee’s and Dine Brands further delayed resolution, a risk that startups can mitigate by implementing bug bounty programs or dedicated security contacts.

The exposure of IP addresses and other personal data also serves as a reminder of the potential legal and reputational consequences of such lapses, particularly for companies subject to regulations like the SEC’s cybersecurity disclosure rules. Startups handling customer data must prioritize not only fixing vulnerabilities but also having a response plan for incidents, including customer notifications and regulatory filings.

Related on Lazyfounder

• Dutch Police Arrest Alleged ShinyHunters Leader Linked to Murder Plot Investigation
• More technology news