--- title: Applebee’s exposed customers’ personal data after... description: A hardcoded database password inside Applebee's Android app exposed customer personal data to anyone who extracted it. Researcher Robert Wiggins used AI to... canonical: https://daily.dev/posts/applebee-s-exposed-customers-personal-data-after-leaving-database-password-in-app-rytxbqqpa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Applebee’s exposed customers’ personal data after leaving database password in app | daily.dev og:description: A hardcoded database password inside Applebee's Android app exposed customer personal data to anyone who extracted it. Researcher Robert Wiggins used AI to... og:url: https://daily.dev/posts/applebee-s-exposed-customers-personal-data-after-leaving-database-password-in-app-rytxbqqpa og:image: https://api.daily.dev/og/posts/rYtxbqqPA.png og:image:alt: Applebee’s exposed customers’ personal data after leaving database password in app og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Applebee’s exposed customers’ personal data after leaving database password in app **[TechCrunch](https://daily.dev/sources/tc)** · 4 min read · 0 upvotes · 0 comments ## Summary A hardcoded database password inside Applebee's Android app exposed customer personal data to anyone who extracted it. Researcher Robert Wiggins used AI to find the credential buried in the app's source code, which had over a million downloads on Google Play. The exposed database included names, emails, dates of birth, phone numbers, ZIP codes, veteran status, login counts, and IP addresses of recent logins. The credential could have also let an attacker modify customer data. Applebee's parent company Dine Brands says it found no evidence of unauthorized access, though it would not confirm how many of its at least 8.5 million rewards program customers as of last year were affected. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What personal data was exposed in the Applebee's app security flaw? The exposed database contained customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses from recent logins. A hardcoded database password inside Applebee's Android app allowed unrestricted access to this data, and could have also let someone modify customer records. _Developers handling similar customer data risks follow breach disclosures like this on daily.dev._ ### Why is hardcoding a database credential inside a mobile app considered a severe security vulnerability? Storing a password or private key directly in app code lets anyone who extracts the app's binary pull out the credential and log into the remote system as an authorized user. This happened with Applebee's Android app, where a researcher found the credential buried inside thousands of lines of decompiled source code, granting access to the full customer database. _Teams auditing their own apps for hardcoded secrets can track incidents like this on daily.dev._ ## Similar posts on daily.dev - [Burger King Japan data breach exposes 11 million customer records](https://daily.dev/posts/burger-king-japan-data-breach-exposes-11-million-customer-records-07r1ueyd3) · BleepingComputer · 0 upvotes · 0 comments - [Starbucks Discloses Data Breach Affecting Hundreds of Employees](https://daily.dev/posts/starbucks-discloses-data-breach-affecting-hundreds-of-employees-pliaagwou) · IT Security Guru · 0 upvotes · 0 comments - [DoorDash confirms data breach impacting users’ phone numbers and physical addresses](https://daily.dev/posts/doordash-confirms-data-breach-impacting-users-phone-numbers-and-physical-addresses-uqflwqnoi) · TechCrunch · 0 upvotes · 0 comments - [LastPass says hackers stole customer data through a supply chain breach at Klue](https://daily.dev/posts/lastpass-says-hackers-stole-customer-data-through-a-supply-chain-breach-at-klue-cot1tyrco) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/applebee-s-exposed-customers-personal-data-after-leaving-database-password-in-app-rytxbqqpa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Applebee’s exposed customers’ personal data after leaving database password in app","url":"https://daily.dev/posts/applebee-s-exposed-customers-personal-data-after-leaving-database-password-in-app-rytxbqqpa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/applebee-s-exposed-customers-personal-data-after-leaving-database-password-in-app-rytxbqqpa"},"datePublished":"2026-10-30T21:53:52.117Z","dateModified":"2026-10-30T21:54:21.680Z","description":"A hardcoded database password inside Applebee's Android app exposed customer personal data to anyone who extracted it. Researcher Robert Wiggins used AI to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/495cb0e5ef89e519b7e85742faeac676?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/495cb0e5ef89e519b7e85742faeac676?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/applebee-s-exposed-customers-personal-data-after-leaving-database-password-in-app-rytxbqqpa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"Applebee’s exposed customers’ personal data after leaving database password in app"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/applebee-s-exposed-customers-personal-data-after-leaving-database-password-in-app-rytxbqqpa#faq","mainEntity":[{"@type":"Question","name":"What personal data was exposed in the Applebee's app security flaw?","acceptedAnswer":{"@type":"Answer","text":"The exposed database contained customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses from recent logins. A hardcoded database password inside Applebee's Android app allowed unrestricted access to this data, and could have also let someone modify customer records. Developers handling similar customer data risks follow breach disclosures like this on daily.dev."}},{"@type":"Question","name":"Why is hardcoding a database credential inside a mobile app considered a severe security vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Storing a password or private key directly in app code lets anyone who extracts the app's binary pull out the credential and log into the remote system as an authorized user. This happened with Applebee's Android app, where a researcher found the credential buried inside thousands of lines of decompiled source code, granting access to the full customer database. Teams auditing their own apps for hardcoded secrets can track incidents like this on daily.dev."}}]} ```