Applebee’s forced to fix serious security issue that exposed customer data
follow us
Add us as a preferred source on Google
- Applebee’s fixes mobile app flaw that exposed customer data through encrypted database credentials
- Investigators found access to personal information, including names, contact details, birthdays, and account metadata.
- No evidence of abuse was found, but the incident highlights the persistent risk of secrets encoded in the software.
Applebee’s has fixed a serious flaw in its mobile app that exposed sensitive customer information to virtually anyone. At this time it is not known if someone malicious actually found this vulnerability and exploited it.
The chain has an Android mobile app that allows customers to browse the menu, customize meals, place orders for delivery or pickup, save their favorites, or receive personalized food recommendations.
A security researcher at What Security named Robert Wiggins used AI to analyze the app’s source code and found a big hole: encrypted credentials for a company database.
Latest videos ofTechnologyRadar
Notify the business
The database contained a lot of sensitive information: customer names, their email addresses (both verified and unverified), dates of birth, phone numbers, zip codes, veteran status, number of logins, account creation dates, and the IP address of the most recent login session.
We don’t know exactly how many people had their sensitive data exposed that way, but the app has over a million downloads on the Google Play Store.
Wiggins soon realized that there was no way to report the problem to either Applebee’s or its parent company, Dine Brands, so he contacted TechCrunch. The publication verified his claims by finding the exposed credentials, and even created a new entry that Wiggins was then able to extract, and also confirmed that the credentials allowed users to modify database entries.
TechCrunch managed to contact Dine Brands, who plugged the hole and thanked everyone involved: “We thank TechCrunch and the security researcher for bringing this matter to our attention,” the company said. “Our security team quickly launched an investigation and has currently found no evidence of unauthorized access.”
“Our investigation is ongoing and we will take appropriate action based on our findings,” the company added.
Encrypted credentials are a very common mistake that sometimes has dire consequences. During production, software developers would leave the login credentials inside the code to work faster, allowing the application to skip the tedious identification process every time. However, the credentials are supposed to be temporary and are typically removed from the code before release.
Sometimes, however, credentials are not detected during the final code review and end up in the live version. Criminals who scan the codes for vulnerabilities can use the information for unauthorized access.
A common mistake
Unfortunately, it is a very common problem. In March 2025, security researchers from cyber news analyzed more than 156,000 iOS apps and found more than 815,000 encrypted secrets, thousands of which were “very sensitive and could directly lead to data breaches or leaks.” It’s worth mentioning that in this case, a “secret” means more than just passwords: it also includes API keys and encryption keys. The average app code exposes 5.2 secrets and 71% of apps leak at least one secret, Cybernews reported at the time.
A few months later, in July, HPE fixed a similar bug in Aruba’s Instant On access points, and around the same time, a similar flaw was found in Cisco’s Unified CM, an enterprise-grade IP telephony call control platform that provides voice, video, messaging, mobility, and presence services.
The leaks continued into 2026: In February, news broke that Chinese state-sponsored threat actors were abusing encrypted credentials found in RecoverPoint for Dell virtual machines.
Applebee’s did not notify its customers about the incident and did not publicly disclose it on its website or social channels at the time of this publication. Furthermore, there is no indication that any threat actors have mined this data or leaked it to the dark web.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment