Applebee's fixes a flaw that exposed customers' personal data

A researcher found a database password hidden in the code of Applebee's Android app, which has more than a million downloads. It let anyone read customers' records, and could have let an attacker change them.

Data exposed

• Names and email addresses
• Dates of birth
• Phone numbers and ZIP codes
• Veteran status
• IP addresses of recent log-ins

The database held names, email addresses, dates of birth, phone numbers and ZIP codes, plus veteran status and recent log-in IP addresses.

Rewards members as of last year

8.5 million, at least

Applebee's had at least 8.5 million customers in its rewards program last year, but would not say how many were exposed.

Dine Brands, Applebee's parent company, says it has found no evidence of unauthorized access so far. It would not say whether it keeps logs that could show it.