Key facts
- A hardcoded password in Applebee's Android app exposed customer data.
- The exposed data included names, email addresses, dates of birth, and phone numbers.
- Dine Brands stated it has found no evidence of unauthorized access.
- The security flaw was discovered by cybersecurity researcher Robert Wiggins.
Applebee's has resolved a security vulnerability that exposed personal data of its customers after a cybersecurity researcher found a hardcoded password within the company's Android mobile application. The password granted access to a customer database containing names, email addresses, dates of birth, phone numbers, and other personal details. Cybersecurity researcher Robert Wiggins discovered the flaw, using AI to locate the credential embedded in the app's source code. TechCrunch verified the findings and confirmed that the database was accessible. Dine Brands, Applebee's parent company, stated on Friday that its security team has investigated and found no evidence of unauthorized access, adding that its investigation is ongoing.