Applebee’s Android app shipped with a database password written directly into its code, and that credential unlocked records on registered customers. A U.K.-based security researcher, Robert Wiggins of What Security, found the flaw in October 2026 and could not find anyone at the restaurant chain to tell. The Applebee’s rewards program counted at least 8.5 million members as of last year, but nobody has said how many accounts the password actually exposed.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
A hardcoded credential in the Android package
Hardcoded credentials rank among the most severe kinds of software flaw, because anyone who downloads an app can unpack it, pull the key out and log in as an authorized user. The Applebee’s Android app has more than a million downloads on Google Play, so the pool of people able to extract the password was large. Wiggins used an AI model to find the credential among thousands of lines of the app’s source code, and he said the same access could have let an attacker change customer data as well as read it.
TechCrunch’s Zack Whittaker reported the story on Oct. 30 and held it until Applebee’s had fixed the problem. TechCrunch decompiled the app itself and confirmed the password was present, then created a test account filled with dummy data that Wiggins was able to retrieve from the database. Wiggins works at the U.K. firm What Security and has surfaced exposed data before, including a 2018 TechCrunch story on the teen-monitoring app TeenSafe. He is active on X as @Random_Robbie.
The design problem is old and well understood. An Android app is a package that anyone can open, so a secret stored inside it is shared with every person who installs it. The usual alternative is to have the company’s servers check each logged-in user’s own session and limit that session to the one account it belongs to, which leaves nothing in the app worth stealing.
Fields in the Applebee’s customer database
The records Wiggins retrieved included customer names, email addresses along with whether each address had been verified, dates of birth, phone numbers and ZIP codes. The database also held veteran status, a count of how many times each customer had logged in, the date each account was created, and the IP address of the most recent login. That last field can reveal an approximate location. Birthdates, phone numbers and verified email addresses are the kind of details used to make phishing messages convincing, which is why the field list matters even without payment data.
TechCrunch’s list of exposed fields does not include payment card numbers.
The scale is the least certain part of the story. Applebee’s rewards program had at least 8.5 million members as of last year, according to Customer Experience Dive, and that figure is the only public benchmark for the size of the database. Wiggins told TechCrunch that establishing the real count would have required his AI model to access potentially every customer record, a step he did not take. Applebee’s would not say how many customers were affected, so 8.5 million is a membership floor rather than a confirmed count of exposed accounts.
Disclosure with no security contact
Wiggins tried to reach Applebee’s and its parent company, Dine Brands, before going to the press. Neither company publishes a way to report a security problem, which left him without a channel for the report. He asked TechCrunch to relay the finding instead. Applebee’s confirmed on Thursday that it had acted to fix the issue, and TechCrunch published once that fix was in place.
The missing contact matters beyond this one case. A company that publishes a security email address or a vulnerability disclosure program gives a finder a direct route, and the fix can arrive before any reporter is involved. Here the route ran through a newsroom, which had to verify the claim independently, wait for the repair and then ask a corporate spokesperson for comment. Wiggins said he approached TechCrunch because no one at the company could be reached, and that left a window in which the password remained live while the story was being checked.
Dine Brands’ statement and the open questions
A Dine Brands spokesperson, who was not named, told TechCrunch by email on Friday that the company thanked the publication and the researcher. The spokesperson said the security team had not currently found any evidence of unauthorized access, and that the investigation was ongoing, with appropriate steps to follow depending on what it finds.
Several questions were still open when the story ran. The spokesperson would not say whether server logs exist that could show who queried the database, and the company did not say how long the credential had been sitting in the app. TechCrunch also asked whether Applebee’s would notify customers or U.S. regulators, including through a filing with the SEC, and reported no answer. Without access logs on the record, the statement that no unauthorized access has been found rests on the company’s own review, and the 8.5 million membership figure stays as the outer bound of who could have been affected.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
