Applebee’s Fixes Android App Flaw That Exposed Customer Database Password
Applebee’s fixed an Android app flaw exposing a database password and customer data, but the number affected and any unauthorized access remain unclear.
Summary
Applebee’s fixed a security flaw on October 29, 2026, after Robert Wiggins, a U.K. researcher at What Security, found an internal database password hardcoded in its Android app, which has more than 1 million Google Play downloads. Wiggins used AI to locate the credential among thousands of lines of source code. It allowed anyone to access registered customers’ records and potentially modify them. Testing with a dummy Applebee’s account confirmed the exposure.
The database contained names, email addresses and verification status, birth dates, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and recent login IP addresses that could reveal approximate locations. Dine Brands said on October 30 that its ongoing investigation had found no evidence of unauthorized access, but would not confirm whether usable server logs exist. The affected total remains unknown because counting records would have required accessing potentially every customer entry. Applebee’s had at least 8.5 million rewards members in 2025. Neither Applebee’s nor Dine Brands offered Wiggins a security reporting channel, and the company has not answered how long the credential was exposed or whether it will notify customers, regulators, or the U.S. Securities and Exchange Commission.
Positives
- Applebee’s removed the exposed credential and blocked further access on October 29, 2026.
- Dine Brands’ investigation had found no evidence of unauthorized database access as of October 30.
- AI helped Robert Wiggins locate the credential among thousands of lines of Android app code.
- Wiggins avoided determining the affected total because doing so could have accessed every customer record.
Risks & concerns
- More than 1 million Google Play downloads potentially distributed the hardcoded database credential.
- The credential allowed unauthorized access to customer records and could have enabled attackers to modify data.
- Exposed fields included contact details, birth dates, veteran status, account activity, and IP addresses indicating approximate locations.
- At least 8.5 million rewards members existed in 2025, but Applebee’s has not disclosed how many records were exposed.
- Dine Brands would not confirm whether server logs can establish if anyone accessed the database.
- Applebee’s and Dine Brands lacked security reporting channels, while exposure duration and customer, regulator, or SEC notifications remain unresolved.