conv.

All stories
SecurityQuiet 10d · day 12

Applebee's left a database password hardcoded in its app, exposing customer data

A researcher used AI to find an exposed credential buried in Applebee's Android app, giving access to customers' personal records before the company patched it.

newest coverage 10d agosummary written 11d ago13 pieces8 likes & upvotes2 comments MastodonNewswiresRedditBlueskyHacker News

What to know

  • A hardcoded database password embedded in Applebee's Android app exposed names, emails, dates of birth, phone numbers, ZIP codes, veteran status and login IP addresses of registered customers.
  • The researcher used AI to locate the credential inside thousands of lines of app code and could not report it directly because Applebee's and Dine Brands lack a security disclosure channel.
  • Applebee's fixed the flaw after TechCrunch intervened; Dine Brands says it has found no evidence of unauthorized access but won't confirm whether server logs exist to verify that.
  • The scope of affected customers is unknown; Applebee's rewards program had at least 8.5 million members as of last year.

“Our investigation is ongoing, and we will take appropriate steps based on our findings.”

Dine Brands spokesperson, Company spokesperson · TechCrunch ↗ · Oct 29

Robert Wiggins Security researcher at What SecurityDine Brands Parent company of Applebee'sApplebee's Restaurant chain whose app exposed the data

Applebee's left a database password hardcoded in its app, exposing customer data
techcrunch.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 5 pieces in 3h at Oct 30, 4 PM; 13 pieces over 12 days (1 article · 12 posts) Oct 30, 4 PM — 5 pieces · 1 article · 4 posts — Mastodon 3, Newswires 1, Reddit 1Oct 30, 7 PM — quietOct 30, 10 PM — quietOct 31, 1 AM — quietOct 31, 4 AM — quietOct 31, 7 AM — quietOct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — 1 piece · 1 post — Bluesky 1Oct 31, 7 PM — 1 piece · 1 post — Mastodon 1Oct 31, 10 PM — quietNov 1, 1 AM — 1 piece · 1 post — Bluesky 1Nov 1, 3 AM — quietNov 1, 6 AM — 1 piece · 1 post — Bluesky 1Nov 1, 9 AM — quietNov 1, 12 PM — 2 pieces · 2 posts — Hacker News 1, Mastodon 1Nov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — 1 piece · 1 post — Bluesky 1Nov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — 1 piece · 1 post — Bluesky 1Nov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietNov 10, 12 AM — quietNov 10, 3 AM — quietNov 10, 6 AM — quietNov 10, 9 AM — quietNov 10, 12 PM — quietNov 10, 3 PM — quietNov 10, 6 PM — quietNov 10, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quiet 1
Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9Nov 10now · 12:50 AM ET
  1. 1

    TechCrunch discloses the exposure and Dine Brands responds

    TechCrunch verified the flaw by decompiling the app and creating a dummy account that Wiggins could retrieve from the database; Dine Brands said its investigation has so far found no evidence of unauthorized access but would not say whether it has server logs to check.

    “We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.”
    — Dine Brands spokesperson
    1. 1 outlet Applebee’s exposed customers’ personal data after leaving database password in app

      first by TechCrunch, 12d ago

    • 365tipu.cz

      Applebee’s odstranila bezpečnostní chybu, která komukoli umožňovala přístup k osobním údajům zákazníků. Stalo se tak poté, co výzkumník objevil heslo k interní databázi v mobilní aplikaci techcrunch.com/2026/... ___________________ #prihlasit odběr 365tipu.

      365tipu.czBluesky10d ago1▲view on Bluesky ↗
    2 more of the top 3 · 5 posts in this stretch
    • DevaOnBreaches@infosec.exchange

      Applebee’s has fixed a security flaw in its Android app that exposed customer database access through a hardcoded password. The exposed data included names, email addresses, phone numbers, birth dates, ZIP codes and IP addresses. https:// techcrunch.com/2026/10/30/appl ebees-exposed-customers-personal-data-after-leaving-database-password-in-app/

      DevaOnBreaches@infosec.exchangeMastodon11d agoview on Mastodon ↗
    • dustcircle.bsky.social

      #Applebee’s exposed #customers’ #personaldata after leaving #database #password in app

      dustcircle.bsky.socialBluesky10d ago1▲view on Bluesky ↗
    all of them →
  2. background

    Applebee's patches the exposed credential — The restaurant chain took action to close off unauthorized access to its customer database after being notified via TechCrunch, since Applebee's and Dine Brands had no channel for researchers to report security issues directly.

  3. background

    Researcher finds hardcoded database credential in Applebee's app — U.K.-based researcher Robert Wiggins used AI to locate a password for an internal database buried in thousands of lines of code in Applebee's Android app, which has over a million downloads.

What people are saying 2 voices from 1 site · best of 5 · verbatim