Applebee's Fixes Flaw That Exposed Rewards Customer Data Through Its Android App

Applebee's has fixed a security flaw that let anyone reach the personal information of its registered customers, according to a TechCrunch report published on October 30, 2026. The exposure came from a password for an internal customer database that had been left inside the company's mobile app.

U.K.-based cybersecurity researcher Robert Wiggins of What Security found the lapse in October 2026. He used AI to locate the credential, which was buried in thousands of lines of source code in Applebee's Android app. The app has more than one million downloads on Google Play. The hardcoded credential granted access to the customer database and could also have allowed changes to customer data.

TechCrunch verified the findings by downloading and decompiling the Android app, a process that converts the compiled package back into readable code, and confirming that the exposed credential was present. It then created an Applebee's account populated with dummy data, which Wiggins retrieved from the company's database.

The exposed database held customer names, email addresses, email verification status, dates of birth, phone numbers and ZIP codes. It also included veteran status, login counts, account creation dates and the IP addresses of most recent log-ins. Applebee's had at least 8.5 million customers enrolled in its rewards program as of 2025.

Wiggins could not alert Applebee's or its parent company, Dine Brands, directly, because neither offered a way to report security issues. TechCrunch withheld publication until the bug was confirmed fixed.

Dine Brands said its security team promptly investigated the Applebee's issue and had not currently found evidence of unauthorized access. The company declined to say whether it keeps server logs that would show whether anyone accessed the database.

In my view, the technical root cause is an old one. A secret compiled into a client app is effectively public, because anything shipped to a device can be decompiled and read. The credential did not need to be sophisticated to be exposed, only to exist in the wrong place. What has changed is the cost of finding it. Locating a single string in a large codebase once took persistence and luck. AI-assisted searching of decompiled or source code cuts that effort sharply, so a secret that sits in an app for months is now far more likely to be found by someone outside the company.

The broader context here is the disclosure gap. An app with more than a million downloads, tied to a rewards program with millions of members, gave an outside researcher no route to report a critical finding. Organizations that publish a security contact or a vulnerability disclosure policy give researchers a channel that does not depend on a news outlet. That channel is inexpensive to set up, and it is the piece most often missing when a flaw like this surfaces.

The same tooling that located this credential can also work in the other direction. Secret scanning in continuous integration, which runs automated checks before a build ships, can catch hardcoded credentials at the point where they are cheapest to remove. In this case, the fix came only after an outside party found the problem. The people whose names, dates of birth and log-in IP addresses sat in that database had no part in the discovery.