Applebee's app left a database password open to anyone

A security researcher found a password to an Applebee's customer database tucked inside the chain's Android app, and it let anyone who had the app look up registered customers' personal details. Applebee's says it has fixed the problem. It also says it has found no evidence that anyone broke in. Whether anyone did is not yet clear.

What happened

Robert Wiggins, a researcher at What Security in the U.K., found the password earlier this month. He used AI to search thousands of lines of the app's code. The app has more than a million downloads on Google Play.

Leaving a password inside an app is called hardcoding a credential. It is a serious mistake because anyone can pull the password out of the app and use it to log in as if they were authorized. Wiggins said it could also have let an attacker change customer data.

TechCrunch confirmed the finding. It made a test account with fake details, and Wiggins was able to pull that information from the company's database.

What was exposed

• Names, email addresses and whether the email was verified
• Dates of birth, phone numbers and ZIP codes
• Veteran status, login counts and account creation dates
• IP addresses from recent logins, which can hint at where a person is

Passwords and payment card details were not on the list TechCrunch described.

Who it affects

Anyone with an Applebee's account could be in the database. Applebee's had at least 8.5 million rewards members as of last year. The company would not say how many people had their information exposed. The report names the Android app. It does not say whether the iPhone app was involved. If you never made an Applebee's account, this does not touch you.

What is still unknown

Wiggins could not warn Applebee's or its parent company, Dine Brands, because neither offers a way to report security problems. He asked TechCrunch to pass it along. Dine Brands thanked both of them and said its investigation is ongoing.

Several questions are open. The company would not say whether it keeps server logs that could show who accessed the database. It did not say how long the password was in the app. It also did not say whether it will notify customers or U.S. regulators.

What to do

The main risk is scams. Criminals who have your name, phone number and birth date can write messages that look real. The alert box above lists the steps to take now. If Applebee's or Dine Brands contacts you about this, check that the notice is real before acting on it.