> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Applebee's app left a database password in its code, exposing customers' personal data
- URL: https://www.skimwire.com/applebees-app-database-password-customer-data-exposed/
- Published: 2026-10-31T12:42:22.000Z
- Updated: 2026-10-31T12:42:22.000Z
- Description: Names, emails, birth dates, phone numbers, ZIP codes and veteran status were reachable. Applebee's fixed it but won't say how many were exposed.
- Author: Jeremy Moon
- Tags: Security

## The skim

- Applebee's Android app had a database password built into its code. Anyone who pulled it out could reach rewards members' names, emails, birth dates, phone numbers, ZIP codes and veteran status, TechCrunch reported Friday.
- The same credential could also be used to change customer records. Applebee's says it fixed the problem on Thursday, after TechCrunch got in touch.
- Parent company Dine Brands says it has "not currently found any evidence of unauthorized access," but it won't say whether it keeps logs that could prove that. It also hasn't said how many people were exposed.

## What happened

Security researcher Robert Wiggins of UK firm What Security found the hardcoded credential with help from AI tools and alerted [TechCrunch](https://techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/?ref=skimwire.com), because he couldn't find a way to report it to Applebee's or Dine Brands. TechCrunch confirmed the issue itself by decompiling the app, which has been downloaded more than a million times from Google Play, and found the same password in the code.

According to TechCrunch, the database held customers' names, email addresses and whether those were verified, dates of birth, phone numbers, ZIP codes and veteran status. It also held the number of times each customer had logged in, when the account was created and the IP address of their most recent login. Because the credential let users modify data, a bad actor could have changed records as well as read them.

After TechCrunch contacted the company, Applebee's took action on Thursday to fix the problem. In a statement, Dine Brands thanked TechCrunch and the researcher and said its security team "promptly launched an investigation." It added: "Our investigation is ongoing, and we will take appropriate steps based on our findings."

## Why it matters

Putting a database password inside an app is a basic mistake. Anyone can download an Android app and unpack it, and attackers scan apps for exactly this kind of secret. It's also a sign of what's changing: Wiggins used AI tools to find the flaw, and attackers have the same tools.

The exposed fields matter, too. A name, birth date, phone number and ZIP code are enough to make phishing texts and emails look convincing, and veteran status is a detail many diners may not realize the chain keeps. Applebee's rewards program had at least 8.5 million members as of last year, according to TechCrunch, though it's unclear how many records were in this database. Dine Brands didn't say how long the password was in the app or whether it would tell regulators or customers.

If you use the Applebee's app, there's nothing to change on your end yet, since the exposed credential belonged to Applebee's, not to you. Be extra wary of messages that use your birthday or ZIP code and claim to be from Applebee's, especially ones offering rewards or asking you to "verify" your account.

## What's next

The key question is whether Dine Brands has logs going back far enough to show who, if anyone, used the password before Thursday. Without them, "no evidence of unauthorized access" can't rule it out. As a public company, Dine Brands would have to file with the SEC if it decides the incident is material, and US state breach laws could require notices if it finds that someone got into the data. It hasn't said it will do either.

*Sources:* [*TechCrunch*](https://techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/?ref=skimwire.com) *and* [*Privacy Affairs*](https://www.privacyaffairs.com/applebees-app-data-exposure/?ref=skimwire.com)*.*