Applebee’s Breach: Customer Data Compromised Due to Neglected Database Password in App
Applebee’s has addressed a security vulnerability that previously allowed unauthorized individuals to access the personal data of registered customers. This issue was identified after a researcher discovered a password for an internal database within the Applebee’s mobile application.
On Thursday, the well-known restaurant chain announced that it had implemented measures to rectify the security flaw and safeguard its customer database from unauthorized access.
The release of this article was delayed until the bug was confirmed as resolved.
Robert Wiggins, a cybersecurity expert from the U.K. and part of What Security, uncovered the security issue earlier this month. Wiggins is experienced in identifying various types of security flaws, including those that expose sensitive information to the public.
Utilizing artificial intelligence, Wiggins found a hardcoded credential hidden within the source code of Applebee’s Android application, which boasts over a million downloads on Google Play. This credential granted access to the company’s customer database.
Hardcoding credentials in software is considered one of the most serious security vulnerabilities, as it allows anyone with access to the app to extract the key and log into a remote system, impersonating an authorized user.
Wiggins noted that the exposed credential could have enabled a malicious actor to alter customer data within the database.
To verify Wiggins’ claims, an investigation was conducted by downloading and analyzing the source code of Applebee’s Android app, which confirmed the presence of the exposed credential. A test account was also created, allowing Wiggins to access and retrieve information from the company’s database.
The compromised database included significant customer information such as names, email addresses (along with email verification status), birth dates, phone numbers, and ZIP codes. Other details included veteran status, login frequency, account creation dates, and IP addresses from the latest logins, which can indicate a user’s approximate location.
Wiggins was unable to report the issue to Applebee’s or its parent company, Dine Brands, due to a lack of a proper reporting channel for security concerns. He then sought assistance from a media outlet to disclose the issue.
A representative from Dine Brands acknowledged the situation and stated that the security team promptly began an investigation but found no evidence of unauthorized access at that time.
When questioned, the spokesperson did not clarify whether the company had server logs to check for signs of database access or if any logs existed at all.
The investigation is still ongoing, and the company intends to take appropriate actions based on the findings.
The extent of the data exposure remains unclear, though Wiggins mentioned that determining the number of affected customers would have required unnecessary access to potentially every record in the database.
As of last year, Applebee’s had approximately 8.5 million customers enrolled in its rewards program, but the company has not disclosed how many individuals had their personal data compromised in this incident.
Inquiries were made about whether the company would notify affected customers or relevant regulatory bodies regarding the incident, including any possible disclosure to U.S. financial authorities, as required for publicly traded firms. The duration for which the exposed credential existed in the app has not been clarified either.
This article will be updated with any responses from the company.
