The Applebee’s app for Android contained a password that opened the restaurant chain’s customer database to anyone who extracted it, a UK-based security researcher found. Applebee’s has since fixed the flaw, according to TechCrunch, which held its report until the fix was confirmed on Thursday 29 October.
The researcher, Robert Wiggins of What Security, described it on X as “a recent find of mine”. TechCrunch says he used AI to help find the credential “buried inside thousands of lines of source code”. The app is published on Google Play by Applebee’s parent company, Dine Brands Global, and its Play Store listing shows more than one million downloads.
In brief
- A password to Applebee’s customer database sat inside its Android app, according to TechCrunch.
- Names, emails, dates of birth, phone numbers and recent login IP addresses were reachable. How many people were affected is unknown.
- Applebee’s has fixed the flaw. Dine Brands says it has found no evidence of unauthorised access so far.
What the Applebee’s app exposed
According to TechCrunch, the exposed database held customer names, email addresses (including whether each address had been verified), dates of birth, phone numbers and ZIP codes. It also held veteran status, how many times each customer had logged in, when accounts were created, and the IP address of each customer’s most recent login, which can reveal a rough location.
TechCrunch says it checked the finding by downloading and decompiling the Applebee’s app, then creating an account with dummy details. Wiggins was then able to retrieve that test account’s data from the company’s database. He told TechCrunch the credential could also have let an attacker change customer data, not just read it.
How many people were affected is not known. Wiggins said counting the records would have meant accessing potentially every one of them. TechCrunch notes that Applebee’s had at least 8.5 million members in its rewards programme as of last year, but that is a figure for members, not for people whose data was exposed.
A Dine Brands spokesperson, who did not give their name, told TechCrunch: “Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.” The spokesperson added that the investigation is ongoing, but would not say whether the company keeps server logs that could show whether anyone else used the password.
A hardcoded password and no way to report it
Storing a password inside an app, known as hardcoding credentials, is a basic mistake with serious consequences. Any copy of the Applebee’s app that carried the password handed it to whoever installed it. Anyone willing to unpack the app could find it, and the same AI-assisted code search that helped Wiggins is available to criminals too. Once a secret ships inside software downloaded more than a million times, it should be treated as public.
The second problem is how the flaw came to light. TechCrunch says Wiggins could not alert Applebee’s or Dine Brands because “neither have ways to report security issues”, so he asked the publication to help. A published vulnerability disclosure policy, or even a monitored security email address, costs little and lets researchers report problems quickly and privately. Without one, a fix depends on a journalist passing the message on.
The open question is the logs. “No evidence of unauthorized access” is only as strong as the records behind it. If the database did not record who connected with that password, the absence of evidence tells customers little. Dine Brands also has not said how long the password was in the app, whether it will notify customers, or whether it has told regulators. Breaches such as the Muji app breach, the Florida financial aid breach and the Revolve data breach have each come with a disclosure to customers or regulators. Here, so far, there is only a statement to the press. More coverage is in our ransomware and cyber attacks hub.
What Applebee’s app users should do
- Watch for phishing. Names, emails, phone numbers and dates of birth are enough for a convincing fake offer or rewards message. Open the Applebee’s app or website directly rather than following links in unexpected emails or texts.
- Change your password if you reuse it. Account passwords are not among the fields TechCrunch lists, but changing a reused password is a sensible precaution.
- Update the app. Install the latest version from the official store.
- Treat birthday and location details as known. Be wary of callers or messages that use them to sound legitimate.
Sources
- TechCrunch, Zack Whittaker, “Applebee’s exposed customers’ personal data after leaving database password in app”, 30 October 2026: https://techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/
- Robert Wiggins (@Random_Robbie), post on X, 30 October 2026: https://x.com/Random_Robbie/status/2116289376682492285
- Google Play, Applebee’s app listing (developer Dine Brands Global, Inc.): https://play.google.com/store/apps/details?id=com.olo.applebees
- What Security, “About Me” (Robert Wiggins): https://www.what-security.co.uk/about/
Related stories
- Muji Says App Breach May Have Exposed Up to 27.26m Customer Records
- Florida Financial Aid Website Breach May Have Exposed 4.9 Million
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
