Applebee's has resolved a serious security vulnerability that exposed the personal information of registered users, following the discovery of a database password hidden inside the company's Android app, TechCrunch reports. The restaurant chain confirmed on Thursday that it took action to address the issue.
Key takeaways
- Robert Wiggins discovered the credential inside the Android app earlier this month.
- The exposed database contained names, emails, phone numbers, and dates of birth.
- Applebee's stated its security team launched an ongoing investigation.
- Dine Brands did not disclose how many customers were affected.
How did the customer data leak happen?
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, used AI to locate the credential buried within thousands of lines of source code in the Applebee's Android app. The app has more than a million downloads on Google Play. Storing passwords inside software, known as hardcoding credentials, is a severe security risk. Anyone who extracts the key can log in to a remote system as an authorized user.
TechCrunch verified the findings by decompiling the Android app to examine its source code. The exposed database held customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, log-in counts, account creation dates, and recent IP addresses. Wiggins noted that an attacker could have also modified customer data.
What did Dine Brands say about the database password?
Wiggins could not alert Applebee's or parent company Dine Brands directly because neither entity provides a vulnerability reporting channel. He asked TechCrunch for assistance in disclosing the problem. A Dine Brands spokesperson stated on Friday that the security team launched an investigation promptly and found no evidence of unauthorized access so far.
The company would not confirm whether it maintains server logs to check for past access. Applebee's had at least 8.5 million customers in its rewards program last year, but the company declined to specify how many records were exposed. It remains unclear how long the credential stayed inside the mobile app.
What happens next?
Dine Brands stated that its investigation remains active and that the organization will take appropriate steps based on future findings. The restaurant chain did not respond when asked if it plans to notify U.S. regulators, file a disclosure with the U.S. Securities and Exchange Commission, or alert affected customers about the incident.
Frequently asked questions
U.K.-based cybersecurity researcher Robert Wiggins from What Security discovered the exposed credential inside the mobile app earlier this month.
The database contained customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, account creation dates, log-in counts, and recent IP addresses.
Robert Wiggins used AI to help find the credential buried inside thousands of lines of source code in the Applebee's Android app.
A Dine Brands spokesperson stated that the security team launched an investigation and has not currently found any evidence of unauthorized access.
It is unclear how many customers were affected because determining the exact number would have required the AI model to access every customer record.
Based on reporting by TechCrunch. Read the original article
