Applebee's fixes app credential flaw that exposed customer data

Applebee's exposed registered customers' personal information through a database password embedded in its Android app, TechCrunch reported Friday. The chain confirmed Thursday that it had addressed the flaw. Researcher Robert Wiggins found the credential with AI assistance. TechCrunch independently confirmed its presence and verified access by having Wiggins retrieve dummy information from a test account. Exposed records included names, email addresses, birth dates, phone numbers, ZIP codes, veteran status and recent login IP addresses. Wiggins said the credential could also allow changes to customer data. Dine Brands said its ongoing investigation had found no evidence of unauthorized access. The number of affected customers is unclear; the company declined to say whether it had logs to establish access.