Applebee’s has patched a glaring security flaw in its Android app after a researcher discovered that a database password was hardcoded into the app, giving anyone who decompiled it direct access to customer data. The company, owned by Dine Brands, said the issue has been resolved and is investigating possible unauthorized access.
Earlier this month, a U.K.-based cybersecurity analyst uncovered credentials for an internal database buried in the Android version of Applebee’s app, which has over a million downloads on Google Play. Using AI to sift through thousands of lines of source code, the researcher identified the hardcoded password that could unlock the customer database. Such credentials allow an attacker to masquerade as an authorized user, posing a serious threat.
What Data Was Exposed?
Once inside the database, the exposed information included customers’ names, email addresses (including verification status), phone numbers, dates of birth, ZIP codes, and their veteran status. Other sensitive details uncovered were the number of times customers logged in, timestamps for account creation, and IP addresses of recent logins, which could be used to glean approximate locations. The researcher confirmed these findings with a dummy account, successfully retrieving the data directly from Applebee’s database.
Response and Unanswered Questions
Applebee’s confirmed it was alerted to the issue and promptly initiated an investigation. In a statement, it said there is currently no evidence that any unauthorized access occurred. However, the company has not disclosed how long the hardcoded credential remained in the app, nor whether there are server logs to trace access. The total number of impacted users remains unknown. To put that in perspective, Applebee’s had at least 8.5 million members in its rewards program as of last year.
Notably, when the researcher tried to report the flaw, they found no dedicated channel at either Applebee’s or its parent company, Dine Brands, to submit security vulnerabilities. The researcher ultimately sought help through a media outlet to facilitate disclosure.
Why This Matters: Hardcoding database credentials into an app is one of the most severe security missteps—it effectively hands attackers the keys to sensitive systems. Leakage of personally identifiable information at this level could expose users to phishing, identity fraud, or privacy violations. For a major chain with millions of users enrolled in loyalty programs, the implications are particularly worrying.
It remains crucial for Applebee’s to clarify exactly how many users were affected, how long the vulnerability existed, and whether logs or monitoring revealed misuse. Regulators may pay attention—many require public disclosure for material cybersecurity incidents. Users should reset passwords if they used the app recently and monitor for suspicious activity.
