Applebee's exposure: a password hidden in its Android app gave access to a customer database with names, birth dates and phone numbers
TechCrunch reported on October 30, 2026 that a password for an internal Applebee's customer database was hidden inside its Android app, giving anyone who extracted it access to names, email addresses, dates of birth, phone numbers and ZIP codes; the flaw is fixed and the company says it has found no evidence of unauthorised access.
What happened
TechCrunch reported on October 30, 2026 that a password for an internal Applebee’s customer database had been shipped inside the restaurant chain’s own Android app, where anyone who unpacked the app could extract it and use it to log in to the database. UK-based researcher Robert Wiggins of What Security found the hardcoded credential earlier in October, using an AI tool to search thousands of lines of the app’s source code; the app has more than a million downloads on Google Play. TechCrunch verified the finding itself: it downloaded and decompiled the app, confirmed the credential was in the code, created an Applebee’s account with dummy data, and watched Wiggins retrieve that dummy record from the company’s database. Wiggins said the credential could also have allowed an attacker to modify customer data, not just read it.
Applebee’s parent, Dine Brands, confirmed on Thursday that it had taken action to address the issue to prevent unauthorised access to the database, and TechCrunch withheld publication until the flaw was confirmed fixed. A Dine Brands spokesperson said on Friday: “Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access,” adding that the investigation is ongoing. This report is labelled POTENTIAL EXPOSURE for exactly that reason: the database was verifiably reachable with the shipped password, but the company says it has found no evidence anyone other than the researcher used it — and when TechCrunch asked whether the company even has server logs it can review to check, the spokesperson would not say.
Who is affected
Registered customers whose records sat in the database the app’s password opened. The database contained customer names, email addresses (including whether the customer had verified the address), dates of birth, phone numbers and ZIP codes, plus veteran status, the number of times a customer had logged in, when their account was created, and the IP address of their most recent login — which can reveal a person’s approximate location. Payment card details were not among the fields TechCrunch reported in the database, and no customer passwords were listed among them either.
How many customers were exposed is unknown, and the company would not provide a number. Applebee’s had at least 8.5 million customers enrolled in its rewards programme as of last year, but that is programme enrolment, not an affected count for this flaw, and this desk does not present it as one. Wiggins said he deliberately did not count the records, because doing so would have meant accessing potentially every customer record. The company also did not say how long the credential had been in the app, or whether it will alert customers or US regulators.
How serious
The concrete risk is targeted phishing and identity-check abuse. A name paired with a date of birth, phone number, email address and ZIP code is the standard material for convincing scam messages and for passing weak “confirm your identity” checks, and the veteran-status field lets a scammer aim military-themed lures — fake benefits, discounts or charity appeals — at the people most likely to trust them. The recent-login IP addresses add approximate location, which makes a message feel local and genuine. What this data does not do on its own is open the customer’s Applebee’s account or take payment: no passwords or card details were among the reported fields. The seriousness sits in the exposure window nobody has yet measured — a password that shipped to more than a million app installs was, for an unknown period, a standing key to the database, and the company has not confirmed it can check its logs for other uses of it.
What to do now
There is no password to change on the strength of this disclosure, because no customer passwords were among the reported fields, and the company has fixed the flaw. What to do is raise your guard on Applebee’s-branded contact: a text or email that quotes your birthday, phone number or veteran status and asks you to click, pay or “verify” something proves nothing — those details are exactly what was exposed. Open the official app or website directly instead of following any link in a message.
If you are a veteran in the database, treat unsolicited military-discount or benefits messages with extra suspicion for the same reason. And if Dine Brands does notify customers or file a regulatory disclosure, follow the instructions in that official notice — this report will be updated if the company publishes an affected count or an exposure period.
Sources: TechCrunch, October 30, 2026