Applebee’s fixes hardcoded database password in Android app

Applebee’s reported at least 8.5 million rewards program customers as of 2025, and a hardcoded database password in its Android app exposed customer data to unrestricted access when security researcher Robert Wiggins discovered it; Applebee’s confirmed fixing the security flaw on Oct. 30, 2026. The credential was embedded in the app’s source code, allowing extraction and potential misuse. Applebee’s confirmed fixing the security flaw on October 30, 2026, after the credential was discovered. The company did not confirm how long the exposed credential had been in the app before discovery.

The exposed database held account creation dates, login counts, veteran status, ZIP codes, phone numbers, dates of birth, e-mail addresses with verification status, customer names and IP addresses from recent logins. That sensitive personal and behavioral information concerns Applebee’s customers. The hardcoded credential could have allowed attackers to modify customer data in the database, a severity that extended beyond data exposure to potential data manipulation.

Dine Brands, Applebee’s parent company, stated it found no evidence of unauthorized access to the database on Oct. 30, 2026. The company’s investigation is ongoing, but no one has reported confirmed misuse of the credential.

Wiggins used AI tools to locate the hardcoded credential in the app’s source code. AI-assisted analysis helped identify the embedded secret in the app’s codebase. Hardcoding credentials in mobile apps is a severe security vulnerability because it allows anyone with access to the app to extract and misuse the embedded secret.

The practice is widely recognized as a critical flaw in application security. Hardcoded credentials in mobile apps are a recurring security failure in restaurant and retail applications. They create risks even if not exploited because attackers can extract and reuse them. The presence of such credentials poses ongoing threats regardless of immediate misuse.

A hardcoded credential is a password or secret written directly into an app’s code rather than kept on a secure server. Mobile apps are public artifacts, and their contents can be reverse-engineered to uncover embedded secrets like database passwords.

That makes an embedded database password especially dangerous in a widely distributed restaurant app. Mobile apps should not rely on hardcoded credentials for backend access and should instead use server-controlled application programming interfaces with short-lived authentication tokens. That approach separates sensitive operations from client-side applications.

Hardcoded credentials in apps can also be accidentally exposed in source repositories, testing environments or third-party tools. The risk of credential exposure extends beyond the app itself to related development environments. This issue highlights a broader industry problem with embedding sensitive credentials in client-side software.

Applebee’s is also connected to a separate 2026 data breach at Apple American Group, its largest franchisee. That breach came to light on April 9, 2026, and exposed biometric information, health records, financial data and Social Security numbers covering at least 8,447 individuals in Vermont, Rhode Island and California. The breach involved highly sensitive personal and financial information.

Apple American Group faced eight class-action lawsuits over the incident and notified affected individuals around Aug. 18, 2026, approximately four months after discovery. The delay in notification is a point of contention in related lawsuits. The lawsuits allege the breach involved unencrypted and improperly redacted personal data. The breach led to legal action.

Applebee’s did not provide a response to questions about whether it would notify customers or U.S. regulators, including filing a disclosure with the SEC. The company’s lack of transparency leaves questions about customer communication unanswered. AndroGuider says customers should monitor for phishing attempts, unauthorized account activity and unexpected password-reset notices following a data exposure report, and Applebee’s has not said whether it will notify affected rewards members directly.