As detailed in TechCrunch, Applebee's has resolved a significant security vulnerability that potentially exposed the personal information of its registered customers.
The issue originated from a hardcoded password discovered within the source code of the company's Android application. Robert Wiggins, a cybersecurity researcher based in the United Kingdom, identified the credential using artificial intelligence. This vulnerability allowed unauthorized access to an internal database containing sensitive user details, including names, email addresses, dates of birth, phone numbers and ZIP codes. Additional exposed information included veteran status, account creation dates and recent IP addresses. Hardcoding credentials is considered a severe security risk, as it permits anyone who extracts the key to interact with remote systems as an authorized user. While the company confirmed it addressed the flaw after being notified, it has not disclosed how long the credential remained exposed or if any unauthorized parties accessed the data. Dine Brands, the parent company, stated its investigation is ongoing. The incident highlights the critical importance of secure software development practices, as the restaurant chain manages millions of accounts through its rewards program. The company has not yet confirmed if it will notify affected customers or regulators regarding the potential data exposure.
Source: TechCrunch
