Applebee’s Fixes Security Flaw That Exposed Customer Data Via Hardcoded App Password

Applebee's recently addressed a security vulnerability that allowed unauthorized access to registered customer information after a database password was discovered inside its mobile application. Robert Wiggins, a U.K.-based cybersecurity researcher, found the credential buried within the source code of the Android app using AI assistance.

Following notification through reporting channels, the restaurant chain confirmed it took action to resolve the issue. Parent company Dine Brands stated that its security team launched an investigation, though it remains unclear how many individuals were affected or how long the credential was present in the software.

Overview of the Security Issue

• Discovery Method: A researcher used AI to analyze source code in the Android application and found a hardcoded database password.
• Exposed Information: The database contained customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and recent login IP addresses.
• Potential Impact: Hardcoding credentials allows anyone extracting the key to access remote systems and potentially modify data.

Company Response and Verification

• Action Taken: Applebee's secured the database after being alerted, and the reporting outlet verified the findings by examining the app's code and testing dummy account retrieval.
• Investigation Status: Dine Brands reported an ongoing investigation but has not disclosed server log details or whether affected customers and regulators will be notified.
• Reporting Gap: The researcher noted that neither Applebee's nor Dine Brands provided a direct mechanism for reporting security vulnerabilities.

Practical Implications and Verification

• Customer Vigilance: Registered users should monitor their accounts for unusual activity given the exposure of personal details and login metadata.
• Verifying Announcements: Users can check official statements from Dine Brands or updates from cybersecurity reporting outlets to confirm future disclosures regarding the incident.