Applebee's app exposed customer data through a hardcoded database password
- Severity
- Medium
- Sources
- 2
What happened
Applebee's Android app contained a hardcoded database credential that allowed unrestricted access to an internal customer database, which a researcher found with AI assistance and TechCrunch independently verified using a test account. Exposed fields included names, emails, verification status, dates of birth, phone numbers, ZIP codes, veteran status, account creation dates, login counts and last-login IP addresses. Applebee's confirmed remediation on October 29; Dine Brands reports no evidence of unauthorised access but its investigation is ongoing, and no CVE has been stated. Defenders should rotate any credential embedded in client code, restrict database access, and review logs for access before the fix.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Be wary of unexpected Applebee's emails, texts or calls, especially those offering refunds or warning that your account will be closed.
- Do not follow links in unexpected messages; open the Applebee's app or website directly to check for security notices.
- Do not share payment details in response to any message claiming you need to verify them.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Who and what is in it
Companies