Hardcoded Password Left Applebee’s Customer Database Exposed

Wiggins utilized AI to scan the app’s code, identifying credentials that could have allowed malicious actors to view or modify sensitive records. The exposed database contained names, email addresses, dates of birth, phone numbers, and ZIP codes. Furthermore, the records included veteran status, account creation dates, and IP addresses, which can pinpoint a user's approximate location. TechCrunch independently verified the vulnerability by creating a dummy account and confirming that data could be retrieved using the exposed key.

Despite the severity of the flaw, Applebee’s parent company, Dine Brands, lacks a public channel for reporting security vulnerabilities. Following the disclosure, a company spokesperson stated that an investigation is underway, though they declined to clarify if server logs exist to determine if the data was accessed by third parties. While Applebee’s reported at least 8.5 million rewards program members last year, the company has not disclosed how many users were impacted or whether it intends to notify federal regulators regarding the breach.