Applebee's app shipped a database password that exposed customers' personal data

TLDR

• TechCrunch reports a hardcoded database password in Applebee's Android app let anyone access registered customers' personal data.¹
• Exposed fields included names, emails, birth dates, phone numbers and ZIP codes; the number of customers affected is unclear.¹
• Applebee's has fixed the flaw; Dine Brands says it has not currently found evidence of unauthorised access.¹

TechCrunch reports that Applebee's has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside the company's mobile app.¹ The researcher, Robert Wiggins of What Security in the UK, discovered the lapse earlier this month, using AI to help find the credential buried in thousands of lines of source code in Applebee's Android app, which has more than a million downloads on Google Play.¹ TechCrunch says it withheld publication until the bug was confirmed to be fixed, and that Applebee's confirmed on Thursday it had taken action to prevent unauthorised access to its customer database.¹

TechCrunch says it verified Wiggins's findings by downloading and decompiling the Android app to confirm the credential was present, and by creating an Applebee's account with dummy data that Wiggins was then able to retrieve from the company's database.¹ The exposed database held customer names, email addresses (including whether the email was verified), dates of birth, phone numbers and ZIP codes, along with veteran status, login counts, account creation dates and the IP addresses of recent log-ins, which TechCrunch notes can reveal approximate location.¹ Wiggins said the same credential could also have let an attacker modify customer data in the database.¹ He was unable to alert Applebee's or its parent company Dine Brands because neither has a way to report security issues, so he asked TechCrunch to help with disclosure.¹

A Dine Brands spokesperson, who did not give their name, said in an emailed statement on Friday that the company's security team "promptly launched an investigation and has not currently found any evidence of unauthorized access."¹ TechCrunch reports the spokesperson would not say whether the company has server logs it can review to check if anyone accessed the database, or whether it has any logs at all.¹ The company added: "Our investigation is ongoing, and we will take appropriate steps based on our findings."¹

TechCrunch reports it is unclear how many customers were affected, because Wiggins said counting the records would have required the AI model to access potentially every customer record unnecessarily.¹ Applebee's had at least 8.5 million customers enrolled in its rewards programme as of last year, TechCrunch says, though the company would not say how many had their personal information exposed.¹ TechCrunch also asked whether the company would alert customers or US regulators, including through a filing with the Securities and Exchange Commission, and how long the credential had been in the app, and says it received no response.¹ Every detail here comes from TechCrunch's reporting, which the outlet says it will update if the company responds.¹

Why it matters: a credential shipped inside a public app can be extracted by anyone who downloads it, and TechCrunch reports Applebee's has not said how long it was exposed, how many customers were affected or whether it will notify them.¹