Applebee's fixes app flaw that exposed customer data
A researcher found a hardcoded database password in the Applebee's Android app, which has more than a million downloads on Google Play. Parent company Dine Brands says it has not found evidence of unauthorized access.
Robert Wiggins, a researcher at What Security in the United Kingdom, found the password in the app's code. The database held customer names, emails, dates of birth, phone numbers and other data. Wiggins said an attacker could also have used the password to change customer data.
Dine Brands, which owns Applebee's, said its security team started an investigation. A spokesperson said the team has not currently found evidence of unauthorized access.
Applebee's had at least 8.5 million rewards members as of last year.
Key facts
- Who
- Applebee's (restaurant chain whose app contained the credential); Robert Wiggins (British researcher at What Security who found the credentials); Dine Brands (company that owns Applebee's, said it launched an investigation)
- What
- According to the headline and description, Applebee's exposed customers' personal data after leaving a database password hardcoded in its app, which a security researcher discovered. The description says this allowed unrestricted access to customers' personal data.
- When
- 30 October 2026
- Status
- Reported