Applebee’s exposed customers’ personal data after leaving database password in app

Hardcoded credentials in mobile apps are now discoverable by sophisticated AI tools, increasing the risk of data breaches for millions of users.

Applebee's experienced a data security lapse when a researcher discovered a hardcoded password for its customer database within the chain's Android mobile application. Cybersecurity researcher Robert Wiggins utilized AI to find the credential embedded in the app's source code, which granted access to sensitive customer information. This data included names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login history, and IP addresses. Applebee's parent company, Dine Brands, confirmed the issue was fixed and stated they found no evidence of unauthorized access, though they could not confirm if server logs existed to verify this. It remains unclear how many customers were affected, though Applebee's had at least 8.5 million customers in its rewards program last year. The company has not disclosed if it will notify customers or regulators about the incident.

The ease with which AI tools can now scan and decompile mobile applications for hardcoded secrets like passwords represents a significant evolution in cybersecurity threats. What once required manual reverse-engineering can now be automated, lowering the barrier for attackers to find exploitable vulnerabilities. This incident signals that companies must implement more robust security practices, moving beyond simply checking for obvious flaws to anticipating AI-driven discovery of embedded credentials.

For consumers, this means personal data, even from seemingly innocuous apps like those of restaurant chains, could be at increased risk. The trend suggests a need for greater vigilance and potentially new methods for consumers to understand and mitigate their digital footprint. The incident also highlights the challenges companies face in securely managing their codebases, especially as they rely on third-party developers and complex development cycles.