Applebee’s Customer Data Exposed After Database Password Was Found in Its Mobile App

A security vulnerability in Applebee’s Android application exposed registered customers’ personal information after a cybersecurity researcher discovered credentials that provided access to the restaurant chain’s internal database.

The issue has since been fixed, according to Applebee’s parent company, Dine Brands. However, questions remain about how long the credentials were exposed, how many customers may have been affected, and whether anyone accessed the information without authorization.

A database password hidden inside a mobile application

The security issue was discovered by Robert Wiggins, a U.K.-based cybersecurity researcher at What Security. While examining Applebee’s Android application, Wiggins used artificial intelligence to help locate a database credential buried within thousands of lines of application source code.

The discovery revealed a serious security weakness: the application contained a hardcoded credential that could be extracted and used to access the company's customer database.

Hardcoding credentials means placing sensitive information, such as passwords or private keys, directly inside software. This creates a significant security risk because someone who obtains and examines the application may be able to recover those credentials and use them to access systems that should be protected.

Applebee’s Android app has more than one million downloads on Google Play, increasing the potential reach of the exposure.

What customer information was exposed?

According to TechCrunch's investigation, the database contained several categories of personal information belonging to registered customers.

The exposed information included:

1. Customer names
2. Email addresses and email verification status
3. Dates of birth
4. Phone numbers
5. ZIP codes
6. Veteran status
7. Account creation dates and login activity
8. IP addresses from recent account logins

Some of this information could be combined to identify individuals, target them with convincing phishing attempts, or reveal their approximate locations.

Wiggins also warned that the exposed credential could potentially have allowed an attacker to modify information stored in the database, although the report did not establish that such changes occurred.

TechCrunch independently verified the researcher's findings by downloading and examining the Android application. The publication also created a test account using dummy information and confirmed that the researcher could retrieve that account's data from the database.

Applebee’s says it has fixed the vulnerability

After the issue was brought to its attention, Dine Brands confirmed that its security team had investigated and taken steps to address the vulnerability.

The company said it had not found evidence of unauthorized access at the time of its statement. It also said its investigation was ongoing and that it would take appropriate action based on its findings.

However, the company did not clarify whether it had sufficient server logs to determine if anyone had accessed the exposed database before the vulnerability was fixed.

It also did not provide a figure for how many customers may have been affected or explain how long the exposed credential had been present in the application.

Applebee’s had at least 8.5 million customers enrolled in its rewards program as of the previous year. That figure represents the size of its rewards membership, not the confirmed number of people whose information was exposed.

Why hardcoded credentials remain a serious security problem

This incident highlights a security mistake that can affect applications of almost any size.

Mobile applications frequently communicate with remote databases, APIs, and other backend services. If developers place privileged credentials directly inside an application, those secrets may become accessible to anyone capable of inspecting the software.

Even when an application is distributed through an official app store, its internal code should not be treated as secret. Attackers and security researchers can use reverse-engineering tools to inspect how an application works and identify sensitive information embedded within it.

A more secure approach involves keeping sensitive credentials on protected backend systems, using appropriate authentication and access controls, limiting permissions, and regularly rotating exposed secrets.

Organizations should also conduct security reviews before releasing applications and continuously monitor their infrastructure for suspicious activity.

A reminder for businesses handling customer information

The Applebee’s incident is a useful reminder that cybersecurity risks do not always begin with sophisticated attacks or advanced malware. Sometimes, a single development mistake can create an opening into systems containing large amounts of sensitive information.

Businesses that collect customer data through mobile applications, websites, or digital platforms need to consider security throughout the entire development process. Protecting an application interface is not enough if the backend systems it connects to are exposed.

Secure software development, vulnerability assessments, penetration testing, proper credential management, and continuous monitoring all play important roles in reducing these risks.

Applebee’s has addressed the reported vulnerability, but the unanswered questions surrounding the exposure demonstrate why organizations need to identify and fix security weaknesses before they become customer data incidents.