Applebee’s Left a Database Password in Its App, Putting Your Profile at Risk

An Applebee’s app security flaw exposed registered customers’ personal information, including birth dates, phone numbers, and veteran status. Those details could help scammers create convincing emails or texts pretending to come from a company you trust.^[1]

Applebee’s parent company, Dine Brands, said on Oct. 29 that it had addressed the issue. At the time of its statement, the company said it had not found evidence of unauthorized access.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What happened to Applebee’s customer data?

A database password embedded in Applebee’s Android app allowed access to registered customers’ personal information, TechCrunch reported on Oct. 30, 2026.

Researcher Robert Wiggins of What Security discovered the hardcoded credential earlier in October 2026, in Applebee's Android app. TechCrunch said it verified the finding by downloading and decompiling the app, confirming the exposed credential, creating a dummy Applebee's account, and having the researcher retrieve that dummy account information from the customer database.

What personal information was exposed?

The exposed database contained:

• Names
• Email addresses
• Email verification status
• Dates of birth
• Phone numbers
• ZIP codes
• Veteran status
• Number of times customers had logged in
• Account creation dates
• IP addresses of most recent logins

Wiggins said the exposed database password could also have allowed an attacker to modify customer information.

It's unclear how many customer records were exposed, and Applebee's wouldn't provide a number.

What this means for customers

The clearest risk here is targeted phishing, not a confirmed case of identity theft. The reported exposed fields don't include Social Security numbers, payment card numbers, or passwords, but they can still help scammers.

A criminal could use the exposed information to impersonate Applebee’s, a loyalty program, a delivery service, or a veterans-focused organization. Email verification status and login counts could also help an attacker identify active accounts.

Recent login IP addresses add another layer of context. An IP address can point to a general location or network, which could make a scam feel more tailored even if it doesn't reveal your exact home address.

Some of this data doesn't change. Your date of birth and veteran status can remain useful for impersonation attempts long after the exposed app credential has been fixed.

What should Applebee’s customers do?

1. Follow official Applebee's updates. Dine Brands says its investigation is ongoing and that it would take appropriate steps based on its findings. If you receive a notice, use the official Applebee's app or website instead of links in an email or text.
2. Check your Applebee's account profile. Review your name, email, phone number, ZIP code, birth date, and any veteran-status field for unexpected changes. Because the researcher said the credential could have allowed data modification, report unfamiliar changes to Applebee's customer support.
3. Watch for personalized phishing. Be suspicious of messages that mention your birthday, veteran status, ZIP code, or Applebee's account activity. If a message pressures you to click, pay, or confirm personal details, treat it as a possible phishing email or scam text.
4. Secure your email and Applebee's login. Passwords were not reported exposed, but your email account is a key recovery point for many services. Use a unique password, and turn on two-factor authentication wherever it's available.
5. Be careful with birthday and veteran-themed offers. Scammers might pose as restaurants, rewards programs, charities, or veterans groups. Go directly to the organization's official website or app before claiming any offer or sharing more information.
6. Reduce your public contact footprint. Exposed phone numbers and emails are more useful when scammers can combine them with extra data from people-search sites. A data removal service can help limit how easy it is to find contact information.

Bottom line

Applebee’s fixed a flaw that exposed customer information, but exposure does not establish that criminals obtained the data. Check your account for unexpected changes and verify personalized offers or account alerts through the official app or website.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

See Price

On LifeLock's website

2026 Editors’ Choice

Best ID Theft Service for Comprehensive Monitoring

Identity Protection

LifeLock

• ID theft protection with U.S.-based restoration specialists and data removal services
• At least $1.05 million in ID theft insurance on every plan, with the Total plan covering up to $3 million
• Three-bureau credit monitoring available on Advanced and Total tiers

Author Details

Kalleigh Lane

About the Author

Kalleigh Lane is the Managing Editor at All About Cookies, where she helped develop the site's star rating system for product reviews and specializes in testing VPNs, ad blockers, and parental controls on Android and PC. She brings more than five years of experience editing and writing across cybersecurity, tech, and finance, and she has authored and edited over 300 articles for All About Cookies. Before joining AAC, she worked as a journalist and editor at CTV News and the Globe and Mail, and she holds a Master of Arts in English Literature from the University of Toronto.