Applebee's has fixed a security vulnerability that left the personal data of its registered customers exposed, after a cybersecurity researcher discovered a database password hidden inside the restaurant chain's mobile app. The company's parent, Dine Brands, said it has found no evidence of unauthorized access but provided few details on the scope of the exposure.
The vulnerability was discovered by Robert Wiggins, a UK-based researcher at What Security, who used AI to help find a credential buried in the source code of Applebee's Android app, which has been downloaded more than a million times. TechCrunch, which helped with disclosure, confirmed the finding by decompiling the app. It also created an account with dummy data, allowing Wiggins to retrieve the information from the company's customer database.
Hardcoding a password into an application is one of the most severe types of security vulnerabilities because anyone with the app can extract the credential and use it to log in to a remote system as if they were an authorized user. Wiggins said the credential could also have allowed a malicious attacker to modify customer data. The exposed database included customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, the number of times customers had logged in, and IP addresses, which can reveal approximate locations.
Applebee's had at least 8.5 million rewards program members as of last year, but the company did not disclose how many were affected by this incident. Wiggins was unable to report the flaw directly because neither Applebee's nor Dine Brands operates a security reporting mechanism. He contacted TechCrunch, which helped disclose the issue and withheld publication until the company confirmed the fix.
A Dine Brands spokesperson said in a statement: "We appreciate TechCrunch and the security researcher for bringing this matter to our attention. Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access." The spokesperson added that the investigation is ongoing. The company did not respond to questions about whether it would notify customers or U.S. regulators, including whether it would file a disclosure with the Securities and Exchange Commission, or how long the credential had been exposed.
Analysis
Why This Matters
- The exposure of personal data from a major restaurant chain's rewards program could affect millions of customers; the lack of evidence of malicious access does not eliminate the risk that data was viewed.
- The vulnerability type (hardcoded credential) is a common but serious security flaw that bypasses normal authentication; this incident is a reminder of the importance of secure credential management in mobile apps.
- The absence of a security reporting channel at Applebee's and Dine Brands reveals a gap in responsible disclosure practices that could delay the detection and remediation of future vulnerabilities.
Background
Hardcoding passwords or private keys into application source code is a security practice that violates industry best practices. When distributed in apps, these credentials can be extracted by anyone with access to the binary, granting them the same access as the application itself. Applebee's is a large U.S. casual dining chain, and its Android app has been downloaded over a million times. The rewards program included more than 8.5 million members as of last year.
Key Perspectives
Robert Wiggins, cybersecurity researcher at What Security: discovered the hardcoded credential in Applebee's app using an AI tool and said the flaw could have allowed an attacker to modify customer data. He reported the issue through TechCrunch because the company lacked a security reporting mechanism.
Dine Brands, Applebee's parent company: acknowledged the vulnerability, fixed it, and stated that its investigation had found no evidence of unauthorized access. It would not comment on whether it maintains server logs or plans to notify customers or regulators.
What to Watch
- Whether Applebee's or Dine Brands will notify affected customers or regulators, including the Securities and Exchange Commission, given potential legal obligations.
- The outcome of the company's investigation into whether any unauthorized access actually occurred, and whether server logs exist to determine this.
- The possibility that the company establishes a security reporting channel or bug bounty program to improve its vulnerability management.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedApplebee’s fixed a security flaw that exposed customer data through a hardcoded app password.TechCrunch: “Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee’s mobile app”
- SupportedThe researcher used AI to help find the credential.TechCrunch: “Wiggins used AI to help find the credential buried inside thousands of lines of source code in Applebee’s Android app”
- SupportedDine Brands said it had not currently found evidence of unauthorized access.TechCrunch: “Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.”
- SupportedThe flaw left registered customers’ personal data exposed.TechCrunch: “Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers”
- SupportedThe credential was hidden in the source code of Applebee’s Android app, which had more than a million downloads.TechCrunch: “the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play.”
- SupportedTechCrunch confirmed the finding by decompiling the app and retrieved data using an account with dummy data.TechCrunch: “We also created an Applebee’s account with dummy account data, which allowed Wiggins to retrieve our information from the company’s database.”
- SupportedHardcoding a password into an application is one of the most severe types of security vulnerabilities.TechCrunch: “Storing a password or private key in software, known as hardcoding credentials, is one of the most severe types of security vulnerabilities”
- SupportedWiggins said the credential could have allowed an attacker to modify customer data.TechCrunch: “Wiggins said that the hardcoded credential could have also allowed a malicious attacker to modify customer data in the database.”
- SupportedThe exposed database included customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts and IP addresses.TechCrunch: “The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and the ZIP codes. The data also included veteran status, the number of times customers had logged in”
- SupportedThe database’s IP addresses could reveal approximate locations.TechCrunch: “the IP addresses of their most recent logins, which can be used to reveal the person’s approximate location.”
- SupportedApplebee’s had at least 8.5 million rewards program members as of last year.TechCrunch: “Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year”
- SupportedThe company did not respond to questions about customer or regulator notification, a possible SEC disclosure, or how long the credential had been exposed.TechCrunch: “TechCrunch asked the company if it would alert customers or U.S. regulators about the incident, including whether it would file a disclosure with the U.S. Securities and Exchange Commission”