Applebee's app exposed customer data through a hardcoded database password
BREACHApplebee'sredteam/daily · 2 sources
- Severity
- Medium
- Sources
- 2
What happened
Security researcher Robert Wiggins found a hardcoded database credential in Applebee's Android app, which gave access to an internal customer database. The exposed fields included names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, account dates, login counts and IP addresses, but not payment card details or account passwords. Applebee's confirmed the fix on October 29, and parent company Dine Brands says it has found no evidence of unauthorised access while its investigation continues.
For IT people · Written by AI from 2 sources · Wrong?
What to do
- Be wary of unexpected Applebee's emails, texts or calls, especially those offering refunds or warning that your account will be closed.
- Do not follow links in unexpected messages; open the Applebee's app or website directly to check for security notices.
- Do not share payment details in response to any message claiming you need to verify them.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
TechCrunch (Security)Malwarebytes Labs
Who and what is in it
Companies