Applebee's App Vulnerability Exposed Customer Data
A hardcoded password in the Applebee's Android app allowed a security researcher to access a database containing customer names, emails, and other personal information.
A significant security vulnerability in the Applebee's Android application has been discovered, leading to the exposure of customer personal data. Security researcher Robert Wiggins, aided by artificial intelligence, identified a hardcoded password within the app's code. This credential granted him access to an internal Applebee's customer database, revealing sensitive information about patrons.
The exposed data included a range of personal details such as customer names, email addresses, and their verification status. Additionally, dates of birth, phone numbers, ZIP codes, and even veteran status were accessible. The database also contained account creation dates, login counts, and IP addresses from recent customer logins, which could potentially indicate a user's approximate geographic location.
TechCrunch independently verified Wiggins' findings, demonstrating the vulnerability by retrieving dummy information from the database that had been entered into an Applebee's account. Wiggins reportedly faced challenges in directly reporting the vulnerability to Applebee's or its parent company, Dine Brands, prompting him to seek assistance from TechCrunch to facilitate the disclosure.
Following the verification of the fix, Applebee's confirmed on October 29 that the security issue had been addressed. The exact number of customer records affected by the breach remains unclear. Dine Brands has stated that while its investigation is ongoing, no evidence of unauthorized access to the database has been found to date.
While the compromised database did not contain payment card details or account passwords, the exposed personal information poses a risk to customers. Scammers could leverage names, email addresses, and phone numbers to craft more convincing phishing attempts or targeted social engineering attacks.
Customers are advised to remain vigilant and watch for any unusual or suspicious communications, particularly those themed around Applebee's. This includes being wary of unexpected emails, text messages, or phone calls, especially those offering refunds, threatening account closure, or requesting personal information for verification.
To stay safe, users should independently verify any security notices or communications by visiting the Applebee's website directly or opening the app, rather than clicking on links within unsolicited messages. If uncertain about the legitimacy of a message or link, it is recommended to use trusted security tools or contact the company through independently verified channels.
This incident underscores the importance of secure coding practices, including the avoidance of hardcoded credentials, and highlights the ongoing need for robust security measures to protect customer data in the digital age.