Applebee’s exposed customers’ personal data after leaving database password in app
EXCLUSIVE: A security researcher discovered the hardcoded credential in Applebee's app, allowing unrestricted access to customers' personal data.
Applebee's recently resolved a security vulnerability that allowed unauthorized access to its customers' personal data. A U.K.-based cybersecurity researcher, Robert Wiggins, discovered the flaw in Applebee's mobile app, which has over a million downloads on Google Play. Wiggins utilized AI to uncover a hardcoded password within the app's source code, granting access to the company's database.
The compromised database contained sensitive information such as customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login frequency, account creation dates, and IP addresses, which could reveal approximate locations. Although the company has confirmed the issue has been rectified, it remains unclear how many customers may have been affected.
Applebee's and its parent company, Dine Brands, have not disclosed details regarding the extent of the breach or whether they have notified affected customers or U.S. regulators.
Written by urgent.news from TechCrunch's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
