Applebee’s remediates Android app database credential exposure

Applebee’s fixes exposed credential in Android app

Applebee’s has remediated a security flaw in its Android app after a hardcoded database credential allowed access to registered customers’ personal information. The app has more than one million downloads on Google Play, while the number of customers whose data may have been exposed remains unknown.

U.K.-based cybersecurity researcher Robert Wiggins of What Security found the credential earlier this month. He used AI to help locate it within thousands of lines of source code in the Applebee’s Android app. TechCrunch subsequently downloaded and decompiled the application, confirming that the exposed credential was present.

The credential provided access to Applebee’s customer database. TechCrunch created an account using dummy details, and Wiggins was able to retrieve that information from the database. Wiggins said a malicious actor could also have been able to modify customer data.

Customer information and investigation remain in focus

The exposed database contained customer names, email addresses and email-verification status, dates of birth, phone numbers and ZIP codes. It also included veteran status, account creation dates, login counts and IP addresses associated with the most recent logins. Recent-login IP addresses can reveal a person’s approximate location.

Wiggins did not determine the database’s total number of customer records because doing so would have required an AI model to access potentially every record. Applebee’s had at least 8.5 million rewards-program customers as of last year, but the company did not disclose how many individuals had personal information exposed through the flaw.

Wiggins could not report the issue directly because neither Applebee’s nor its parent company, Dine Brands, provided a way to submit security reports. He asked TechCrunch to assist with disclosure. The publication withheld its report until the flaw had been fixed.

Dine Brands says no unauthorized access has been found

A Dine Brands spokesperson said the company appreciated the disclosure and that its security team promptly began an investigation. The company said it had not currently found evidence of unauthorized access and that the investigation was continuing.

When asked whether it had server logs that could be reviewed to establish whether anyone accessed the database, Dine Brands did not say. It also did not answer questions about how long the credential had been embedded in the app, whether customers or U.S. regulators would be notified, or whether it would make a disclosure to the U.S. Securities and Exchange Commission if required.

Hardcoding a password or private key into software makes the secret available to anyone able to obtain and inspect the app, allowing them to authenticate to a remote system as an authorized user. For businesses, the incident underlines the need to remove embedded credentials, rotate exposed secrets, restrict database permissions and retain logs that can support an effective access investigation.