Breaches and incidents
Applebee’s (Dine Brands): customer database password left in Android app exposed rewards members’ personal data
TechCrunch reported that a database password embedded in Applebee’s mobile app allowed access to the customer database, exposing names, email addresses...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- TechCrunch reported that a database password embedded in Applebee’s mobile app allowed access to the customer database, exposing names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and recent-login IP addresses; it is unclear how many customers were affected (the rewards programme had at least 8.5 million members as of last year, per TechCrunch).
- Root cause: a hardcoded database credential in the Android app, found earlier in October by researcher Robert Wiggins (What Security), who said an attacker could also have modified customer data; TechCrunch verified the finding by decompiling the app.
- No attacker named; this was a researcher disclosure.
- Dine Brands said it fixed the issue, “has not currently found any evidence of unauthorized access” and that its investigation is ongoing; it would not say whether logs exist to show who accessed the database.