VULNpocalypse
HighVulnerabilityMonitoring

Applebee’s app leaked a customer database password, exposing personal data

A hardcoded database credential in Applebee’s Android app exposed customer personal data; the flaw is fixed, but Dine Brands says its investigation is ongoing.

Published
Updated
Fixed in
Applebee’s confirmed it fixed the issue on October 29, 2026; the specific app or server change is not confirmed
Exploitation
No confirmed exploitation; Dine Brands says it has found no evidence of unauthorized access, but would not say whether logs exist. A researcher and TechCrunch did retrieve a dummy account record.

What happened

A researcher found a password for an internal Applebee’s customer database inside the company’s Android app, according to TechCrunch. Robert Wiggins, a U.K.-based researcher at What Security, discovered it earlier in October 2026. He used AI to help find the credential among thousands of lines of source code in the app, which has more than a million downloads on Google Play. TechCrunch reports the credential gave access to the customer database, and Wiggins said it could also have let an attacker modify customer data.

TechCrunch verified the finding by downloading and decompiling the Android app and confirming the credential was present. It also created an Applebee’s account with dummy data, and Wiggins was able to retrieve that data from the company’s database.

According to TechCrunch, the exposed data included:

  • Names and email addresses, including whether the email was verified
  • Dates of birth, phone numbers and ZIP codes
  • Veteran status
  • Login counts and account-creation dates
  • IP addresses of the most recent log-ins, which can reveal approximate location

Wiggins could not report the issue directly because neither Applebee’s nor its parent company Dine Brands has a way to report security issues, so he asked TechCrunch to help. TechCrunch withheld publication until the fix was confirmed. Malwarebytes reports that Applebee’s confirmed on October 29 that it had addressed the issue.

A Dine Brands spokesperson said the security team “has not currently found any evidence of unauthorized access” and that the “investigation is ongoing.” The spokesperson would not say whether the company has server logs to check for access, or any logs at all. The number of affected customers is not confirmed. Applebee’s had at least 8.5 million customers in its rewards program as of last year, but the company would not say how many people were exposed. TechCrunch also reports that the company did not say how long the credential had been in the app, or whether it will notify customers, U.S. regulators or the SEC. Those points are not confirmed.

No CVE is referenced in the sources.

Am I affected?

  • Applebee’s customers: If you registered an account, your details may have been in the exposed database. Malwarebytes notes that the fields TechCrunch described did not include payment card details or account passwords. Whether anyone accessed the data before the fix is not confirmed.
  • Developers and security teams: The root cause is a hardcoded credential, which TechCrunch describes as one of the most severe vulnerability types, because anyone with the app can extract the key and log in to the remote system as an authorized user. If your mobile app embeds a database or API secret, the same exposure applies.

What to do now

  1. If you are an Applebee’s customer, be wary of unexpected Applebee’s-themed emails, texts or calls. Be especially skeptical of messages that offer refunds or compensation, warn your account will be closed, or ask you to “verify” payment details (Malwarebytes).
  2. Check security notices through a route you trust. Open the app directly or visit the company website yourself instead of following links in unexpected messages, and find contact details independently.
  3. Watch for notices from Applebee’s or Dine Brands. Notification plans are not confirmed in the sources.
  4. If you ship mobile apps, decompile your own release builds and search them for embedded passwords, keys and tokens. Remove any you find.
  5. Rotate any credential that has ever shipped inside an app. Move database access behind a server side service that authenticates each user and limits what they can read or change.
  6. Publish a way for researchers to report security issues, such as a security contact or disclosure policy. Wiggins could not reach Applebee’s or Dine Brands directly, per TechCrunch.
  7. Keep access logs for customer databases so you can tell whether a leaked credential was used. Dine Brands would not say whether it has such logs.

Sources