Applebee’s has fixed a security vulnerability in its Android app that allowed unauthorized access to a customer database containing names, email addresses, phone numbers, and other personal information. The flaw was discovered by a cybersecurity researcher who used artificial intelligence to locate an exposed database credential within the app’s source code.
Parent company Dine Brands confirmed that it had addressed the vulnerability and launched an investigation into the incident. The company said it had not found evidence of unauthorized access, although the number of potentially affected customers remains unknown.
Researcher Discovers Exposed Database Password Using AI
Robert Wiggins, a UK-based cybersecurity researcher at What Security, discovered the vulnerability in October while examining Applebee’s Android application. The app has more than one million downloads on Google Play, making its source code accessible to anyone who downloads and examines the software.
Wiggins used AI to identify a database credential embedded within thousands of lines of application code. This practice, known as hardcoding credentials, creates security risks because attackers can extract the information and potentially access protected systems without authorization.
The exposed credential provided access to Applebee’s customer database and could also have allowed someone to modify existing customer records, according to Wiggins. TechCrunch independently verified the issue by examining the Android app and creating a test account whose information the researcher successfully retrieved from the database.
Exposed Database Contained Customer Contact and Account Information
The database contained customer names, email addresses, phone numbers, dates of birth, and ZIP codes. It also stored email verification status, veteran status, account creation dates, and the number of times customers had logged in.
Additional records included IP addresses from customers’ most recent logins, which can indicate their approximate geographic locations. However, the total number of customers whose information was accessible through the vulnerability has not been established.
Applebee’s reportedly had at least 8.5 million customers enrolled in its rewards program in 2025. That figure does not establish how many records were exposed, and Wiggins avoided retrieving the entire database because doing so would have unnecessarily accessed additional personal information.
Dine Brands Investigates Potential Unauthorized Access
Wiggins initially struggled to report the vulnerability because neither Applebee’s nor Dine Brands provided a dedicated channel for reporting security issues. He subsequently contacted TechCrunch, which assisted in notifying the company and delayed publication until Applebee’s confirmed the vulnerability had been fixed.
A Dine Brands spokesperson said the company’s security team promptly began investigating after receiving the report and had not identified evidence of unauthorized access. However, the spokesperson declined to confirm whether server logs were available to determine if anyone had accessed the database.
The company also did not disclose how long the credential had been exposed or whether affected customers and regulators would be notified. Its investigation remains ongoing, with further action dependent on the findings.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.