🔓Applebee's App Leaked Login Key Exposing 8.5 Million Rewards Members
Your Applebee's rewards data may have been exposed
TL;DR
A researcher used AI to find a database password buried in Applebee's Android app, exposing names, emails, phone numbers and login IP addresses. Applebee's fixed it, but won't say how many customers were hit or whether it has logs to check for misuse.
A researcher found a working database password sitting in Applebee's Android app, and anyone with it could read customer records. The fix is in, but the story is about how the password got there in the first place. Applebee's says it closed the hole before publication. It hasn't said how many people were affected. If you ship mobile apps, this is the lesson: anything in your APK can be decompiled and read, and that includes credentials. The researcher used AI to dig through thousands of lines of Android source to find the key, which makes this kind of hunt cheap for anyone. Audit your bundles for hardcoded secrets and assume attackers will find them faster than you do. The exposed data included names, emails, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses of recent logins. The database held at least 8.5 million rewards members as of last year. Applebee's would not say whether it keeps server logs that could show if anyone actually pulled the data, and it hasn't answered whether it will notify customers or U.S. regulators.
Key Points
The exposed credential granted full access to Applebee's customer database, which held names, emails, dates of birth, phone numbers, and ZIP codes for rewards program members.
Keep reading — it's free
Enter your email to keep reading — plus the best of AI & tech, daily. Free, forever.
Already a member? Sign in
Comments
Be the first to comment