Applebee’s Android app held a database password exposing customer data
Original title: Applebee’s exposed customers’ personal data after leaving database password in app
Dine Brands says it found no unauthorized access, but would not say whether database logs exist.
Researcher Robert Wiggins of What Security found a hardcoded password in Applebee’s Android app, which has more than a million Google Play downloads, and used it to reach the customer database. TechCrunch confirmed the credential and retrieved a dummy account. Exposed fields included names, emails, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account-creation dates and recent login IP addresses. Dine Brands says the issue is fixed and its investigation has not found unauthorized access.
Unconfirmed: Dine Brands says it has not found unauthorized access, but the number of exposed customers and whether usable logs exist are unconfirmed.
- Wiggins said the credential could also have allowed modification of customer records.
- Applebee’s reported at least 8.5 million rewards members as of last year.
- The company would not say how many customers were exposed or how long the password was present.
- Neither Applebee’s nor Dine Brands had a way for Wiggins to report the issue.
- Dine Brands has not said whether it will notify customers, regulators or the SEC.
Impact: Customer identity, contact, birth date and login IP data exposed
| Product | Affected |
|---|---|
| Dine Brands Applebee’s Android app | — |
- Vendors
- Dine Brands
- Products
- Applebee’s Android app
- Victims
- Applebee’s
- Organizations
- What Security
- Countries
- United States
From the original article
3 min read at techcrunch.com
EXCLUSIVE: A security researcher discovered the hardcoded credential in Applebee's app, allowing unrestricted access to customers' personal data.
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.