Applebee’s fixed Android app flaw that exposed customer data
Summary
A researcher used a password embedded in Applebee’s Android app to access a customer database. TechCrunch verified he could retrieve dummy account data; Applebee’s fixed the flaw, but the number of affected records is unclear.
Key points
- Researcher Robert Wiggins found a hardcoded database password in Applebee’s Android app and used it to access an internal customer database.
- The database contained personal details including names, email addresses, birth dates, phone numbers, ZIP codes, veteran status, account activity and recent-login IP addresses.
- TechCrunch independently verified the access by creating a dummy account and confirming Wiggins could retrieve its information.
- Applebee’s confirmed on October 29 that it had fixed the issue.
- The number of records exposed is unknown. Dine Brands said it has found no evidence of unauthorized access, and its investigation is ongoing.
- The database fields described did not include payment card details or account passwords; the article advises customers to watch for targeted scams.
Article Details
- Victim Organization
- Applebee’s
- Incident Type
- Exposure of a customer database through a hardcoded password in Applebee’s Android app
- Data Types Exposed
- Names
- Email addresses
- Email-verification status
- Dates of birth
- Phone numbers
- ZIP codes
- Veteran status
- Account-creation dates
- Login counts
- IP addresses from customers’ most recent logins
- Affected Records
- Unknown; the number of customer records in the database was unclear.
- Operational Impact
- Applebee’s confirmed that it had fixed the issue. Dine Brands said it had found no evidence of unauthorized access, and its investigation was ongoing. No operational disruption was reported.
- Claim Status
- confirmed