Dine Brands

Applebee's app exposed customer data through a hardcoded database password

Security researcher Robert Wiggins found a hardcoded database credential in Applebee's◼ Android app, which gave access to an internal customer database. The exposed fields included names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, account dates, login counts and IP addresses, but not payment card details or account passwords. Applebee's confirmed the fix on October 29, and parent company Dine Brands◼ says it has found no evidence of unauthorised access while its investigation continues.