The compromised database housed sensitive user details, such as customer names, birth dates, phone numbers, veteran status, and recent login IP addresses. TechCrunch independently confirmed the security lapse by generating a test account that Wiggins quickly retrieved from the exposed servers. While Dine Brands stated it found no proof of unauthorized access, it did not reveal how long the credential remained vulnerable. Applebee's has not disclosed whether it plans to notify its rewards members or report the incident to regulators.
Key points
Hardcoded credentials in public mobile applications can undermine security and expose vas…: Hardcoded credentials in public mobile applications can undermine security and expose vast amounts of sensitive consumer data.
Absence of confirmed server logging makes it difficult to definitively rule out past unau…: Absence of confirmed server logging makes it difficult to definitively rule out past unauthorized access to customer systems.
Companies face ongoing uncertainty regarding regulatory disclosure obligations following…: Companies face ongoing uncertainty regarding regulatory disclosure obligations following the discovery of significant backend security flaws.
Sources checked by our analysis pipeline: 1
Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee’s mobile app, TechCrunch has learned.
The popular restaurant chain confirmed on Thursday that it had taken action to address the security issue to prevent any unauthorized access to its customer database.
TechCrunch withheld publication of this story until the bug was confirmed to be fixed.
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, discovered the security lapse earlier this month. Wiggins is no stranger to discovering security issues, including exposed or sensitive information that should not be publicly accessible.
For this latest discovery, Wiggins used AI to help find the credential buried inside thousands of lines of source code in Applebee’s Android app, which has more than a million downloads on Google Play. The credential allowed access to the company’s customer database.
Storing a password or private key in software, known as hardcoding credentials, is one of the most severe types of security vulnerabilities because anyone with the app…
Connected hardware manufacturers must ensure customer onboarding functions reliably across continuous software revisions. Engineers have configured the Groundrun testing rig to integrate an Espressif ESP32-C6 development board alongside an Android phone via USB. This hardware-in-the-loop environment validates multiple wireless commissioning methods by executing autonomous testing procedures driven by artificial intelligence.
The prospective collaboration aims to implement enhanced safeguards for information flowing into military infrastructure, signaling ongoing commercial technology integration within national defense systems. Protecting these digital pipelines is critical as modern defense networks increasingly rely on complex software to process sensitive operational inputs. Engaging the technology giant highlights military priorities around bolstering cybersecurity for next-generation defense initiatives.
French lawmakers from the Socialist and affiliated group proposed targeting digital providers through an internet traffic levy measured directly by local service providers. Proponents designed the mechanism to capture state revenue from borderless online corporations that frequently escape conventional domestic business taxation. Beyond raising state funds, the legislation aims to compel tech giants to optimize network bandwidth and compress their incoming consumer data streams.