Applebee’s Fixed Security Flaw That Exposed Customer Data via Password Left in Mobile App
A hardcoded password in Applebee’s Android app exposed unrestricted access to customer records, including names, emails, phone numbers, birth dates and IP addresses. Dine Brands patched the flaw after researcher Robert Wiggins’ discovery; it said no unauthorized access was found.
Applebee’s has patched a security vulnerability that exposed customers’ personal information after a researcher discovered a database password embedded directly in the restaurant chain’s Android app, TechCrunch reported on October 30, 2026.
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, found the hardcoded credential earlier in October while examining the source code of Applebee’s Android app, which has more than one million downloads on Google Play. Wiggins used AI to locate the password buried within thousands of lines of code. Once extracted, the credential granted unrestricted access to Applebee’s customer database — and, according to Wiggins, could have allowed a malicious actor to modify customer records as well.
TechCrunch verified the findings independently by downloading and decompiling the app, confirming the exposed credential, and creating a dummy account that Wiggins was then able to retrieve from the database.
The exposed data included customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses from most recent logins — information that can be used to approximate a person’s location.
Applebee’s parent company, Dine Brands, confirmed it had addressed the issue and launched an investigation. A company spokesperson stated that no evidence of unauthorized access had been found so far, though the spokesperson did not confirm whether server logs exist to verify that claim. The company did not respond to questions about customer notifications, regulatory disclosures, or how long the credential had been present in the app.
Wiggins was unable to contact Applebee’s or Dine Brands directly, as neither company maintains a public channel for reporting security issues. He contacted TechCrunch to facilitate disclosure.
Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year. The total number of customers whose data was exposed has not been disclosed. Hardcoding credentials in software is considered one of the most severe categories of security vulnerability, as it gives anyone with access to the app the ability to authenticate to a remote system as an authorized user.