Applebee's App Exposed Customer Data: What Was Open and What to Do

In late October 2026, a security researcher found a hardcoded database password inside the Applebee's Android app that gave anyone who decompiled the app access to customer data. Here is what was exposed, what Applebee's says it did, and what you should watch for if you have an Applebee's rewards account.

#What happened

#The security flaw

On October 30, 2026, TechCrunch reported that a security researcher had found a password for an internal customer database hardcoded inside the Applebee's mobile app's source code.

Hardcoding a credential means anyone who downloads and decompiles the app can extract the password and use it to access the same database the app connects to.

Security researcher Robert Wiggins of What Security in the UK used AI tools to help find the credential in the Android app's code. The app has more than one million downloads on Google Play.

TechCrunch verified the finding by decompiling the app and using the password to retrieve a dummy account it had created.

#What was in the database

According to TechCrunch, the exposed database contained:

• Customer names
• Email addresses (including whether the email was verified)
• Dates of birth
• Phone numbers
• ZIP codes
• Veteran status
• Number of logins
• Account creation dates
• IP addresses of most recent logins (which can reveal approximate location)

Payment card details and account passwords were not among the listed fields.

#Applebee's response

Applebee's confirmed on October 29, 2026, that it had addressed the issue. Its parent company, Dine Brands, told TechCrunch it "has not currently found any evidence of unauthorized access" and said "our investigation is ongoing."

Dine Brands would not say whether it has server logs to determine whether anyone accessed the database, or any logs at all. TechCrunch asked whether the company would alert customers or regulators and how long the credential had been in the app. The company did not respond to those questions.

As of November 2, 2026, Applebee's had not notified customers or publicly disclosed the incident.

#How many customers were affected

It is unclear how many customers were affected. TechCrunch noted that Applebee's had at least 8.5 million rewards members as of last year, but the company would not say how many were exposed.

#No reporting mechanism

Neither Applebee's nor Dine Brands had a way to report security issues at the time of the discovery, according to TechCrunch.

#What to do if you have an Applebee's account

#1. Assume scammers may have your basic info

Even though Dine Brands says it has not found evidence of unauthorized access, Malwarebytes notes that we do not know whether anyone accessed the database before the fix. So watch for targeted scams.

Assume scammers may know:

• Your name
• Your email address
• Your phone number
• Your date of birth
• Your ZIP code

#2. Watch for Applebee's-themed phishing attempts

Be wary of unexpected Applebee's-themed emails, texts or calls, especially messages that:

• Offer refunds or compensation
• Warn that your account will be closed
• Ask you to verify payment details
• Claim there is a problem with your recent order

#3. Do not click links in unexpected messages

If you receive an unexpected message that appears to be from Applebee's, do not click any links or call any phone numbers in the message.

Instead, open the Applebee's app directly or type the website address (applebees.com) into your browser yourself.

#4. Never give sensitive details to someone who contacts you

Your Applebee's password and payment card were not among the listed fields that were exposed, but scammers may still try to trick you into giving them up.

Never give anyone who contacts you:

• A credit or debit card number
• A password or security question answer
• A one-time code sent to your phone or email

Legitimate companies will not ask for these details in an unexpected call, email or text.

#5. Change your password if you reused it

Your Applebee's password was not among the listed fields that were exposed, but if you reused your Applebee's password on other sites, changing it is cheap insurance.

Turn on two-factor authentication where offered.

#6. Consider a credit freeze if you are worried about identity theft

Your birthday is often used as a security question or identity check at banks, credit card companies, and other services.

If you are worried about identity theft, consider a credit freeze. The FTC says anyone can freeze their credit at Equifax, Experian, and TransUnion for free, and it lasts until you lift it.

A credit freeze prevents new accounts from being opened in your name. When you need to apply for credit, temporarily lift the freeze at the bureau the lender uses, then refreeze it afterward.

To freeze your credit, contact all three nationwide credit bureaus:

• Equifax: Equifax.com/personal/credit-report-services, (800) 685-1111
• Experian: Experian.com/help, (888) 397-3742
• TransUnion: TransUnion.com/credit-help, (888) 909-8872

#7. Report scam messages

If you receive a scam text, do not click any links or reply. Forward the message to 7726 (SPAM) to report it to your wireless carrier. The FTC says this helps carriers spot and block similar messages.

Report scams to the FTC at ReportFraud.ftc.gov.

#How it spread

The story spread widely on social media, particularly on X (formerly Twitter), from October 30 to November 3, 2026.

#What makes this exposure different

Most data breaches involve an external attacker breaking into a system. This case is different: the credential was built into the app itself, meaning anyone who downloaded the app and knew how to decompile it could extract the password and access the customer database.

TechRadar noted that at press time, Applebee's had not notified customers or publicly disclosed the incident, and there was no indication the data had been exfiltrated or leaked on the dark web.

Malwarebytes noted that the exposed fields did not include payment card details or account passwords, but emphasized that not knowing whether anyone accessed the database before the fix means customers should remain vigilant for targeted scams.

#The big picture

This incident is a reminder that your birthday, phone number, and email address are often enough for a scammer to make a phishing message feel real. A message that says your full name and knows your birthday looks more legitimate than a generic "Dear customer" message.

UndoLeak erases your data from data brokers and keeps it off.

If you are concerned about how much personal information is available about you online, run a free scan to see where your data appears.

#Sources

1. TechCrunch (Zack Whittaker, October 30, 2026): Applebee's exposed customers' personal data after leaving database password in app
2. Malwarebytes (Pieter Arntz, November 2, 2026): Applebee's customer data exposed by password left in app
3. TechRadar (November 2, 2026): Applebee's forced to fix serious security issue which exposed customer data
4. FTC: Credit Freezes and Fraud Alerts
5. FTC Consumer Alert (June 2023): Have you been getting scammy text messages?