Applebee's Android app, downloaded more than a million times, contained a password to an internal customer database in its source code, TechCrunch reported. Anyone with the app could use it to reach the data. The flaw has since been fixed.
U.K. researcher Robert Wiggins of What Security found the credential earlier this month using AI to search the app's code. TechCrunch decompiled the app and confirmed access with a dummy test account. The database held names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status and recent login IP addresses, and Wiggins said the credential could also have allowed data to be modified.
The number of affected customers is unknown; Applebee's had at least 8.5 million rewards members last year. Parent company Dine Brands said it has found no evidence of unauthorized access but is still investigating, and did not say whether it will notify customers or regulators. Wiggins had no way to report the flaw to the company directly because it had no security reporting channel.