Applebee’s exposed customers’ personal data after leaving database password in app

Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee’s mobile app, TechCrunch has learned. 

The popular restaurant chain confirmed on Thursday that it had taken action to address the security issue to prevent any unauthorized access to its customer database. 

TechCrunch withheld publication of this story until the bug was confirmed to be fixed.

Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the security lapse earlier this month. Wiggins is no stranger to discovering security issues, including exposed or sensitive information that should not be publicly accessible. 

For this latest discovery, Wiggins used AI to help find the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play. The credential allowed access to the company’s customer database.

Storing a password or private key in software, known as hardcoding credentials, is one of the most severe types of security vulnerabilities because anyone with the app can extract the key and use it to log in to a remote system as if they were an authorized user.

Wiggins said that the hardcoded credential could have also allowed a malicious attacker to modify customer data in the database.

TechCrunch verified Wiggins’ findings by downloading and decompiling Applebee’s Android app to examine its source code and confirm that it contained the exposed credential. We also created an Applebee’s account with dummy account data, which allowed Wiggins to retrieve our information from the company’s database.

The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and the ZIP codes. The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent logins, which can be used to reveal the person’s approximate location. 

Wiggins was unable to alert Applebee’s or its parent company, Dine Brands, as neither have ways to report security issues. Wiggins asked TechCrunch for help in disclosing the security issue to the company.

A spokesperson for Dine Brands, who did not provide their name, said in an emailed statement on Friday: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.” 

When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all.  

“Our investigation is ongoing, and we will take appropriate steps based on our findings,” the company added. 

It’s unclear how many customers were affected by the data exposure. Wiggins said that figuring out the number of customers in the database would have required the AI model to unnecessarily access potentially every customer record. 

Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not provide a number of how many customers had their personal information exposed by this security flaw.

TechCrunch asked the company if it would alert customers or U.S. regulators about the incident, including whether it would file a disclosure with the U.S. Securities and Exchange Commission, as publicly traded companies are required to do for material cybersecurity incidents. We also asked the company how long the exposed credential had been in the Applebee’s app, but we did not get a response. 

We’ll update this article if the company responds.