Applebee's Fixes Security Flaw After Hardcoded Database Password Discovered in Mobile App
A cybersecurity researcher discovered that Applebee’s mobile app contained hardcoded credentials within its source code, potentially allowing unauthorized access to the company's customer database. The vulnerability was identified by Robert Wiggins of What Security using AI tools to scan thousands of lines of code in the Android application. The exposed data included sensitive information such as names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, and IP addresses. Dine Brands, Applebee's parent company, confirmed it has addressed the security issue. While the company stated its investigation found no current evidence of unauthorized access, it did not clarify if server logs were available to verify this claim. The scale of the exposure remains unknown, though Applebee’s reported having at least 8.5 million rewards program members as of last year.
Topics: customer privacy cybersecurity flaw data breach hardcoded credentials