Applebee’s recently resolved a significant security vulnerability after a cybersecurity researcher, Robert Wiggins from the U.K.-based What Security, discovered that the restaurant chain’s mobile app contained a hardcoded password granting direct access to its internal customer database. This exposed sensitive personal information belonging to customers, including names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login history, and IP addresses. The researcher used AI to sift through thousands of lines of code in Applebee’s Android app, which has over a million downloads on Google Play, and notified TechCrunch due to the lack of an established security reporting channel at Applebee’s or its parent company, Dine Brands.

The exposed credential represented a severe security flaw because hardcoded passwords in apps allow anyone with access to the app to log in as an authorized user without restrictions. Beyond just viewing data, a malicious actor could have potentially altered customer information in the database. TechCrunch independently verified the vulnerability by creating a dummy account, confirming that it was possible to retrieve private customer data through the exposed database. Despite the seriousness of the breach, Dine Brands stated that there is currently no evidence of unauthorized access and that their investigation remains ongoing.

It is unclear how many customers were potentially affected by the exposure. As of last year, Applebee’s had at least 8.5 million members enrolled in its rewards program, but the exact extent of compromised records has not been disclosed. TechCrunch inquired whether Applebee’s planned to notify customers or U.S. regulators, including the Securities and Exchange Commission, as required for publicly traded companies after material cybersecurity incidents. The company did not respond to questions about the duration the password had been embedded in the app or regulatory notifications.

This incident highlights the critical risks posed by poor security practices such as hardcoding sensitive credentials in software distributed to millions. It also underscores the growing role of independent security researchers and AI-assisted analysis in uncovering vulnerabilities that major companies often overlook. Applebee’s swift action to fix the flaw after it was brought to light reflects increasing pressure on firms to maintain robust cybersecurity measures to protect consumer data in an era when such breaches can lead to significant reputational and regulatory consequences.