Applebee's Aplicativo da Applebee's · Breach

Applebee's fixes flaw that exposed customer data via app password

Oct 30, 2026 · 1 min read

A researcher found Applebee's customer database password hardcoded in the chain's Android app. The credential allowed unrestricted access to names, emails, dates of birth, phone numbers and other data. The company confirmed the fix and says it has found no evidence of unauthorized access; the number of affected customers remains unclear.

By HIFY Radar newsroom Updated 10/30/2026 06:50 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A database password was hardcoded inside Applebee's mobile app. Anyone with the app could extract the credential and access registered customers' personal data, such as names, emails, dates of birth and phone numbers. The company says it fixed the flaw and has so far found no evidence of unauthorized access.

Why it matters

Personal data of the chain's customers was accessible to anyone who examined the app. According to the researcher, an attacker could read and even modify that data, creating fraud, customer and regulatory risk. The company did not say how many customers were affected; the rewards program had at least 8.5 million members as of last year.

What to do

The exposed credential has already been addressed by the company; it must now review database access logs to confirm no one got in, and Applebee's would not say whether it has such logs. The company must also decide whether to alert customers and U.S. regulators. Customers should watch for scams using this data.

For the technical team

Affected: Applebee's Aplicativo da Applebee's, cadeia de restaurantes dos EUA; senha de banco de dados gravada no código (hardcoded), com ace · Applebee's Android app and the company's customer database (parent company Dine Brands). No versions stated in the source.
Exploitation: No exploitation reported. Dine Brands says it 'has not currently found any evidence of unauthorized access.' TechCrunch verified access by creating a dummy account, whose data the researcher retrieved from the database.
Fix: Applebee's confirmed it fixed the flaw and blocked unauthorized access to the database; it did not say how long the credential had been in the app. TechCrunch withheld publication until the fix was confirmed.
Vector: Hardcoded credential: customer database password stored in the source code of Applebee's Android app, with more than a million downloads on Google Play. Anyone with the app could extract the password and log in to the remote system as an authorized user, with no additional authentication.
More details: Robert Wiggins (What Security, U.K.) found the lapse earlier this month using AI to locate the credential in thousands of lines of code; TechCrunch confirmed it by decompiling the app. Exposed data: names, email addresses (and verification status), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and IP addresses of recent logins, which reveal approximate location. Neither Applebee's nor Dine Brands had a way to report security issues. The company would not say whether it has server logs, whether it will alert customers or U.S. regulators (including an SEC filing), or how many customers were affected.