Applebee's app exposed a password that unlocked customer data
Applebee's Android app held a built-in password that opened a customer database, according to TechCrunch. A security researcher found it using AI tools, and the flaw has since been fixed. The chain's owner says it has found no sign of misuse.
Applebee's Android app contained a hardcoded password that opened a database of customer information, according to TechCrunch. The app has been downloaded more than 1 million times.
Security researcher Robert Wiggins of What Security found the credential with help from AI tools, TechCrunch reports. The exposed data included names, email addresses, dates of birth, phone numbers, ZIP codes and veteran status, the outlet says. It also showed login counts and IP addresses.
The credential could have been used to change data, not just read it, TechCrunch reports. That raised the risk that someone could have altered customer records.
Applebee's owner, Dine Brands, said it "has not currently found any evidence of unauthorized access," according to a spokesperson quoted by TechCrunch. The company said its investigation is ongoing.
Applebee's had at least 8.5 million rewards members as of last year, TechCrunch reports. It is not known how many customers' records were in the exposed database. Wiggins said counting them would have meant opening nearly every record.
Applebee's has fixed the flaw, TechCrunch reports. The chain confirmed on Thursday that it had acted to block unauthorized access to the database. TechCrunch says it held its story until the fix was confirmed.
TechCrunch says it checked the finding by downloading and unpacking the Android app's code. Wiggins said the AI helped him find the password buried in thousands of lines of code. TechCrunch asked how long the password had been in the app but did not get an answer.
What we know: A password built into Applebee's Android app gave access to customer data.
What we don't: How many people were affected. Only TechCrunch has reported this so far, and NewsHabit hasn't seen independent confirmation.
Where outlets agree TechCrunch reports Applebee's Android app held a credential that opened customer data.
Where they differ TechCrunch reports the credential could have let someone change data, while Dine Brands says it has found no evidence of unauthorized access.