Applebee’s fixed app flaw that exposed customer data

Applebee’s says it fixed a security flaw that could have allowed anyone to access personal information belonging to registered customers. TechCrunch reports that a researcher found a password for an internal database inside the restaurant chain’s Android app.

Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the credential earlier this month. He used AI to help locate it in the app’s source code. The app has more than 1 million downloads on Google Play.

TechCrunch says it verified the finding by examining the app’s code and testing with a dummy account. The exposed database included names, email addresses and verification status, birth dates, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses from recent logins. Wiggins said the credential could also have allowed someone to modify customer records.

A Dine Brands spokesperson said the company’s security team investigated and had not found evidence of unauthorized access. The company said its investigation is ongoing, but did not say whether it had server logs to check for access. The number of affected customers is unclear. Applebee’s had at least 8.5 million rewards-program members as of last year, but the company did not provide a count of people whose information was exposed.

TechCrunch withheld publication until the flaw was confirmed fixed. It reports that Wiggins had been unable to find a way to report the issue directly to Applebee’s or Dine Brands.