Applebee's Left Its Customer Database Password in Its App: Names, Phone Numbers and Birth Dates Were Open to Anyone, and the Company Won't Say Whether There Are Traces of Who Got In

American restaurant chain Applebee's kept the password to its internal customer database where anyone could find it: in the code of its Android app, downloaded more than a million times from Google Play. Anyone with the app could extract the key and enter the database as an authorized user. The company confirmed on Thursday that it had closed the hole.

The database held names, email addresses, birth dates, phone numbers and postal codes, along with whether the customer is a military veteran, how many times they logged in, when they opened the profile and from which IP addresses they last logged in, which can reveal an approximate location. According to the researcher, an attacker could also change the data, not just read it.

The hole was found by British researcher Robert Wiggins of What Security, with the help of AI that searched thousands of lines of code. Then came the most absurd part: he had nowhere to report it. Neither Applebee's nor parent company Dine Brands has a channel for security reports, so he turned to journalists for help. They confirmed the finding with a test profile using fake data and held the story until the hole was closed.

An unnamed Dine Brands spokesperson says they have so far found no "evidence of unauthorized access." That sounds reassuring, until you see what the company didn't answer: whether it even has logs from which it could check who got in. If it doesn't, "no evidence" just means nobody was watching. Also left unanswered were how long the password sat in the app and whether the company will notify customers and US regulators. The rewards program had at least 8.5 million members last year, but how many were exposed, the company doesn't say.

The AI that helped Wiggins is also available to those with no intention of writing reports. And our phones are full of apps for points, discounts and delivery that ask for our birth date. How many companies in the Balkans have an address where someone can report a hole? And would we even find out about it, if no foreigner came along to pick up the phone?