Applebee’s app exposed customer data via hardcoded password
A security researcher found a password in the app that allowed access to personal information.
By Spark News Desk · · United Kingdom, United States
A security researcher discovered a hardcoded password in Applebee’s mobile app, which allowed unrestricted access to the restaurant chain’s customer database. The flaw exposed personal data, including names, email addresses, phone numbers, and other details.
U.K.-based cybersecurity researcher Robert Wiggins identified the vulnerability using AI to scan the app’s source code. The hardcoded credential could have let attackers not only retrieve but also modify customer data.
Applebee’s confirmed it has addressed the issue to prevent further unauthorized access. TechCrunch verified the flaw and withheld publication until it was resolved. A Dine Brands spokesperson provided a statement but did not mention acknowledgment of TechCrunch’s role.
Why it matters
Customers’ personal data was at risk of exposure or tampering. The incident shows the dangers of poor coding practices for companies handling sensitive information.
Sources
- Rocket Report: Winter is coming for Themis; Cowboy Space adds iron to the fire — Ars Technica
- Applebee’s exposed customers’ personal data after leaving database password in app — TechCrunch
Written by the Spark News Desk with AI assistance and checked against the sources above. See our editorial policy. Spotted an error? Tell us.