Applebee’s Android app exposed customer database password, researcher finds
Applebee’s fixed a flaw in its Android app that exposed a password for an internal customer database, allowing anyone who extracted it to access customer information. The incident matters because the credential could also have enabled changes to customer records, although the company says it has found no evidence of unauthorised access.
UK-based researcher Robert Wiggins found the password in the app’s source code with help from AI, and TechCrunch verified that it could retrieve test account data. The database included names, email addresses, dates of birth, phone numbers, postcodes, veteran status, account details and recent login IP addresses. The number of affected customers is unclear; Applebee’s had at least 8.5 million rewards members last year, and Dine Brands said its investigation is ongoing.
In short
- A password in Applebee’s Android app exposed access to its customer database.
- The data included contact details, birth dates and recent login IP addresses.
- Dine Brands says it found no evidence of unauthorised access; the investigation continues.
Explained simply
Applebee’s is a US restaurant chain owned by Dine Brands Global. It offers a rewards programme, through which customers can create accounts and receive offers or other benefits.
The Android app is software for phones using Google’s Android system. Apps can connect to databases that store customer account details, and passwords help control who can access those records.
Customer data can be used to identify or contact people, while access that allows records to be changed could affect account information. The reported database contained personal and account details, but the number of customers involved is not yet clear.
Read the full article at the source →
Originally published by TechCrunch as “Applebee’s exposed customers’ personal data after leaving database password in app”.