Breach · · 3 min read
Applebee’s app held a password that opened its customer database
A researcher found a database password inside Applebee’s Android app that exposed registered customers’ names, emails, birth dates and phone numbers. It’s now fixed.
Applebee’s has fixed a security flaw in its Android app that let anyone with a copy of the app read its customer database. A security researcher found the problem and TechCrunch confirmed it before reporting it. The company says it hasn’t found signs anyone misused it. If you have an Applebee’s account, here’s what was reachable and what’s worth knowing.
What happened
According to TechCrunch, UK-based researcher Robert Wiggins found a password for an internal customer database inside the code of Applebee’s Android app, which has more than a million downloads on Google Play. He used AI to help search the app’s code. Leaving a password inside an app is known as hardcoding a credential: anyone who downloads the app can pull it out and sign in as if they were the company.
The database held registered customers’ names, email addresses, dates of birth, phone numbers and ZIP codes. It also held veteran status, how many times each person had signed in, when the account was created and the IP address of the most recent sign-in, which can point to an approximate location. Wiggins said the same password could have let an attacker change customer records too.
TechCrunch confirmed the flaw by decompiling the app and by creating a test account, which Wiggins was then able to read back from the database. Wiggins couldn’t report the problem directly because Applebee’s and its parent company, Dine Brands, have no way to report security issues, so he asked TechCrunch to help. TechCrunch held its story until the flaw was fixed.
A Dine Brands spokesperson said its security team “has not currently found any evidence of unauthorized access” and that its investigation is ongoing. The company wouldn’t say whether it has logs that could show who accessed the database, how long the password had been in the app, or how many customers were exposed. TechCrunch notes Applebee’s had at least 8.5 million rewards members as of last year, but that’s not a count of affected people.
What this means for you
There’s no confirmation that anyone other than the researcher and TechCrunch looked at the data. No passwords or payment details were listed among the exposed information. The main risk, if someone did copy it, is a convincing scam message that knows your name, birthday and approximate location.
What you can do
- Watch for reward and birthday scams. Be careful with messages offering free food, rewards or a “birthday deal” that ask you to sign in through a link or share payment details. Open the app or type the address yourself.
- Don’t confirm your birth date to strangers. A caller or message that already knows a few details about you isn’t proof that it’s really the company.
- Delete accounts you don’t use. If you signed up for a restaurant app once and never went back, closing the account means one less database holding your details.
How Frame helps
Frame’s email aliases let you give each app its own address, so a message that reaches the wrong address is an easy sign of a fake, and you can pause an alias that starts getting spam. Frame also keeps a catalog of known breaches, with a short checklist for each. Frame never collects or stores leaked records themselves.
Sources
- TechCrunch, Applebee’s exposed customers’ personal data after leaving database password in app, October 30, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.