Applebee's Fixes Flaw That Exposed Customer Data via Password Hardcoded in Android App

4.0 · 1d ago · US · TECH

The Facts

  • Applebee's fixed a security flaw that let anyone access personal information of registered customers; the flaw was a database credential hardcoded in the Applebee's Android app. TechCrunch only
  • UK-based researcher Robert Wiggins of What Security found the credential earlier this month, using AI to search the app's source code; the app has more than 1 million Google Play downloads. TechCrunch only
  • The exposed database contained customer names, email addresses and verification status, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and IP addresses of most recent logins. TechCrunch only
  • Wiggins said the credential could also have let an attacker modify customer data. TechCrunch verified the finding by decompiling the app and retrieving data from a dummy account it created. TechCrunch only
  • Neither Applebee's nor parent Dine Brands has a way to report security issues, so Wiggins asked TechCrunch to disclose the flaw. TechCrunch withheld publication until the fix was confirmed. TechCrunch only
Dive deeper · 2 more factsShow less
  • A Dine Brands spokesperson said its investigation has not found evidence of unauthorized access and is ongoing. The company would not say whether it has server logs to check, how many customers were affected, how long the credential was in the app, or whether it will notify customers, regulators or the SEC. TechCrunch only
  • Applebee's had at least 8.5 million customers enrolled in its rewards program as of last year; the number affected is unclear. TechCrunch only

Context

Applebee's confirmed it addressed a vulnerability in which a database password was embedded in its Android app, according to TechCrunch. The company says its investigation has found no evidence of unauthorized access, but the scope of exposure and the duration of the flaw remain unknown.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 0.

4 Critical Reader A concrete data exposure affecting a 1M+ download app and potentially millions of rewards customers was fixed, but the company reports no evidence of unauthorized access, the number affected is unknown, and the story is a limited-scope, single-company security fix.
4 News Editor This is a concrete security incident exposing personal data of potentially millions of app users, but the company reports no evidence of unauthorized access, the number affected is unknown, and it is a single-company, technical flaw that has already been fixed, making it a moderate, limited-scope story.
4 Business Analyst A security flaw exposed personal data of a potentially large customer base (millions enrolled, 1M+ app downloads) at a publicly traded restaurant chain, but the company reports no evidence of unauthorized access, the flaw is already fixed, and the impact on markets is limited.
4 Global Affairs Analyst A concrete data-exposure flaw affecting a restaurant chain's app with potentially millions of customers, but the company reports no evidence of unauthorized access and the scope is unclear, making it a limited-impact cybersecurity story rather than major news.
4 Policy Expert A company-level data exposure affecting a rewards database of potentially millions, but the concrete event is a fixed vulnerability with no confirmed unauthorized access, so it is a notable yet limited-impact security story.
4 Science & Tech Analyst A concrete data exposure affecting a potentially large customer base (1M+ app downloads, 8.5M rewards members) is newsworthy, but the company reports no evidence of unauthorized access and the affected count is unknown, so impact is limited for now.
4 Informed Citizen A security flaw exposed personal data of potentially millions of Applebee's rewards customers, but the company reports no evidence of unauthorized access, the fix is already deployed, and the affected count and notification plans remain unknown, so the impact is limited so far.

Source

← All stories