Applebee’s App Flaw Exposed Customer Contact Details

A password embedded in Applebee’s Android app allowed access to an internal database containing customer information. Applebee’s says the flaw has been fixed, but customers should watch for emails, texts or calls that use personal details to appear trustworthy.

What happened

A security researcher found a database password stored directly in the Android app’s code or configuration, according to Malwarebytes Labs. Anyone who extracted that credential could potentially use it to reach the database.

TechCrunch independently checked the researcher’s findings by creating an Applebee’s account with dummy information. The researcher was then able to retrieve that information from the exposed database, Malwarebytes reported.

The researcher reportedly had trouble finding an appropriate way to notify Applebee’s or its parent company, Dine Brands, and asked TechCrunch to help make contact. Applebee’s confirmed on October 29 that it had corrected the issue. Dine Brands said it had not found evidence that anyone accessed the database without permission, although its investigation was still underway.

The source did not disclose how long the credential was exposed, whether anyone other than the researcher used it or how many customer records were accessible.

Who is affected

The database included names, email addresses, phone numbers and other personal details, according to Malwarebytes. The fields described in the report did not contain payment card numbers or Applebee’s account passwords.

It has not been disclosed which customers had records in the database or whether only Android app users were affected. Customers therefore should not assume they are included, but anyone with an Applebee’s account should be cautious about messages that mention the restaurant, an order, a reward or account information.

Personal contact details can make a scam more convincing. A criminal could use a person’s name, email address or phone number to make a fake customer-service message seem connected to a real account.

What to do now

1. Be suspicious of unexpected Applebee’s messages. Do not immediately respond to an email, text or call claiming there is a problem with your order, rewards balance or account. The source did not report a specific scam campaign, but exposed contact details could support targeted messages.

2. Open the official app or website yourself. Instead of tapping a link in a message, close it and navigate to Applebee’s through your usual bookmark, app icon or a manually entered address. Check there for any notice or account issue.

3. Verify requests through a separate channel. If someone claims to represent Applebee’s or Dine Brands, find official contact information independently. Do not use the phone number, email address or link supplied in the suspicious message.

4. Never provide a password or verification code in response to contact you did not initiate. The reported database fields did not include account passwords, so this report alone is not evidence that an Applebee’s password was stolen. A follow-up scam may still try to collect one.

5. Report and delete suspicious messages. Use your email service’s phishing button or your phone’s report-junk option. If you already entered account or payment information on a linked page, change the affected password through the real service and contact the card issuer or bank using the number on your card or statement.