Security Flaw in Applebee’s App Exposed Customer Data

Users of the Applebee’s mobile application may have been victims of a significant data breach. A cybersecurity researcher discovered that the company’s Android app contained a database access password embedded directly into its source code, potentially granting unauthorized individuals access to sensitive customer information. ## How the leak occurred Robert Wiggins, a cybersecurity specialist from the UK, used artificial intelligence to analyse thousands of lines of code within the Applebee’s application. His investigation revealed a 'hardcoded' password embedded directly into the software. This represents a critical security failure, as anyone capable of decrypting the application could access the company’s servers with the same privileges as an authorised administrator. Wiggins confirmed that this vulnerability allowed not only for the viewing of customer information but also for the modification of data within the database. ## What data was at risk The unprotected database contained customers' full names, email addresses, dates of birth, phone numbers, and postcodes. Additionally, information regarding users' veteran status, account creation timestamps, and IP addresses from their last login was accessible, allowing for the estimation of a user's approximate location. Applebee’s reported over 8.5 million registered users last year, though the company has yet to clarify how many accounts were actually accessed. ## Company response and security standards Once the flaw was confirmed, Dine Brands, the parent company of Applebee’s, strengthened its security measures and resolved the issue. A company representative stated that an internal investigation is underway to determine whether any unauthorized parties accessed the data. Notably, the company lacked a dedicated channel for reporting security incidents, forcing the researcher to disclose the information independently. Such incidents serve as a reminder to both developers and users that mobile application security often depends on sound code architecture. Companies that process personal data are obligated to strictly manage access keys and avoid embedding sensitive information directly into their code.