Applebee's Fixes Security Flaw Exposing 1M+ Customer Data
A security researcher discovered hardcoded database credentials in the Applebee's mobile app, exposing sensitive customer information including names, contact details, and birthdays, prompting a swift fix from the company
Applebee's has fixed a serious security flaw in its mobile app that exposed customer data, including names, contact details, and birthdays, after a security researcher discovered hardcoded database credentials. The company's security team found no evidence of unauthorized access, but the incident highlights the risk of hardcoded secrets in software.
The security flaw was discovered by Robert Wiggins, a security researcher from What Security, who used AI to analyze the source code of the app and found the hardcoded credentials. The database contained sensitive information including customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, and IP addresses.
The Applebee's mobile app has more than a million downloads on the Google Play Store, making it a significant target for potential hackers. Dine Brands, Applebee's parent company, was notified of the issue through TechCrunch, and the company's security team promptly investigated the matter.
Dine Brands' security team found no evidence of unauthorized access to the exposed customer data, but the incident serves as a reminder of the importance of secure coding practices. The company has thanked the security researcher and TechCrunch for bringing the issue to their attention.
## What happened next After the security flaw was discovered, TechCrunch verified the claims by finding the exposed credentials and creating a new entry, which Wiggins was later able to extract. The publication confirmed that the credentials allowed users to modify database entries, highlighting the severity of the vulnerability.
## Why it matters The incident highlights the persistent risk of hardcoded secrets in software, which can expose sensitive customer information to potential hackers. The fact that the Applebee's mobile app had more than a million downloads on the Google Play Store makes it a significant target for hackers, and the company's swift response to the issue is a positive step towards protecting customer data.
The incident also underscores the importance of secure coding practices and the need for companies to prioritize customer data protection. As technology continues to evolve, companies must stay vigilant and proactive in identifying and addressing potential security vulnerabilities to protect their customers' sensitive information.
