Applebee's left database password in its app, exposing customers' personal data

A password to the customer database of US restaurant chain Applebee's was embedded in the source code of its Android app, allowing anyone to access personal data of registered customers. The flaw was discovered earlier this month by Robert Wiggins, a UK-based cybersecurity researcher at What Security. The company confirmed on Thursday that it had fixed the problem, and TechCrunch held its report until the fix was verified.

How the password was found

Wiggins used AI to locate the credential among thousands of lines of source code in the Applebee's Android app, which has more than a million downloads on Google Play. Placing a password or private key inside software, known as hardcoding credentials, is among the most severe types of security vulnerability, because anyone with the app can extract the key and log in to a remote system as an authorized user. According to Wiggins, the credential could also have let an attacker modify data in the database.

TechCrunch verified the findings by downloading and decompiling the app and confirming the credential was there. It also created an account with dummy data, which Wiggins was able to retrieve from the database.

What data was exposed

The database held customer names, email addresses (and whether they were verified), dates of birth, phone numbers and ZIP codes. It also contained veteran status, the number of times customers had logged in, account creation dates, and the IP addresses of their latest log-ins, which can reveal approximate location.

The company's response

Neither Applebee's nor its parent company, Dine Brands, has a way to report security issues, so Wiggins asked TechCrunch to help with disclosure. A Dine Brands spokesperson said the security team launched an investigation and has found no evidence of unauthorized access so far, adding that the investigation is ongoing. The spokesperson would not say whether the company has server logs that could be reviewed.

The number of affected customers is unclear. Applebee's had at least 8.5 million customers in its rewards program last year, but the company would not say how many had data exposed. It also did not respond on whether it will notify customers or regulators, or how long the credential had been in the app.