Forgot your password?
Close
typodupeerror
Privacy Databases Security

Applebee's Exposed Customers' Personal Data After Leaving Database Password In App (techcrunch.com) 43

Posted by BeauHD from the not-where-that-belongs dept.
Joe_Dragon shares a report from TechCrunch: Applebee's has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee's mobile app, TechCrunch has learned. The popular restaurant chain confirmed [last Thursday] that it had taken action to address the security issue to prevent any unauthorized access to its customer database. [...] The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and ZIP codes. The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent log-ins, which can be used to reveal the person's approximate location.

[...] When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all. "Our investigation is ongoing, and we will take appropriate steps based on our findings," the company added. It's unclear how many customers were affected by the data exposure. [...] Applebee's had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not provide a number of how many customers had their personal information exposed by this security flaw.

Applebee's Exposed Customers' Personal Data After Leaving Database Password In App More | Reply

Applebee's Exposed Customers' Personal Data After Leaving Database Password In App

Comments Filter:

  • "registered customers"...? (Score:3)

    by ffkom ( 3519199 ) on Thursday November 05, 2026 @07:11PM (#66412329)
    The thought to become a "registered customer" at a restaurant never crossed my mind. I go there to order some food, eat, pay cash, and leave, without having even the smallest of reason to deposit any sensitive data.

    • Many restaurants have loyalty programs. There's no excuse for giving them a real email address though. These days it's easy to just use "Hide My Email" to give them an alias address.

      • I just can't bring myself to sign up for a loyalty program at a restaurant.

        If I eat somewhere often enough for something like that to benefit me, I am known on sight by the host, servers, manager, and maybe the chef. If not, then what is the point of giving out my personal details to strangers? I like personal service. Otherwise, just take my money and leave me alone.

        If I need an app or a loyalty program to eat and drink, I will go somewhere else.

        I do use the loyalty programs at chain shops tho -as long

      • Re: (Score:2)

        by antdude ( 79039 )

        I hate it when they require other information like phone numbers. I wished there were disposable phone numbers and aliases like e-mail addresses (e.g., ant+applebees@domains.edu).

        • Re: (Score:2)

          by pla ( 258480 )
          You realize you can just lie about all of it, right?

          Even if you desperately want that free dessert on your birthday, there's no situation in which Joe Customer would ever care about missing a call from Applebees or the like.

          They also don't need to know your real name, real address (aside from the very few restaurants still doing their own deliveries), or real age (why have just one birthday when you can get free stuff throughout the year at different restaurants). Email could go either way - It's nice t

    • Re: (Score:2)

      by SeaFox ( 739806 )

      I go there to order some food, eat, pay cash, and leave, without having even the smallest of reason to deposit any sensitive data.

      Many of them have registrations so if you're a (hopefully) frequent user of curbside or delivery service you don't have to reenter your address, payment info, etc on every order, and also can keep a record of previous orders so you can reorder your "favorites" easily.

      • You're a brave man. Arguing in favour of trading privacy for convenience isn't a hill I'd risk dying on - especially in these parts.

        • Re: (Score:2)

          by SeaFox ( 739806 )

          You're a brave man. Arguing in favour of trading privacy for convenience...

          Silly rabbit, thinking me explaining the reasoning is somehow agreeing with it.

          Never underestimate the laziness of some people. If they have the money to order out that often the need to type their info chafes at them, they will take a solution that saves them the trouble, regardless of risk. That's how we have people surrendering biometric data for authentication so they don't have to type a password.

          I sometimes order from a restaurant's website for carry-out (I'm not paying an upcharge for delivery + driv

    • My mother, who is not computer literate bought a Yeti mug at Target. She came to me because she wanted to register the warranty online and don't understand how to do that (yes, register a warranty for *a cup*). I tried to explain what this is about but she'll not understand.

    • My thoughts exactly. At times like this I wonder where the "app guy" - the one who used to post AC here - is when we need him.

      Apps!

  • Hilarity. (Score:3)

    by MachineShedFred ( 621896 ) on Thursday November 05, 2026 @07:45PM (#66412379) Journal

    This is why I refuse to download any and all "apps" for some pissant discount or "free" item. Your data becomes available at the whims of the worst security in the world.

    I do not trust Applebee's to have proper security hygiene. I expect absolutely nobody at Applebee's has ever read the 12-Factor App manifesto [12factor.net].

    I expect them to have secrets checked into code.
    I expect them to have horrible practices behind the scenes because of impatience and shortcuts.

    I also expect this from any and all other restaurant chains and retail operations that demand my pollution of my phone with their bullshit.

    But I would be remiss in not making a reference to the appy app apps guy. I kind of miss him.

    Apps!

    • I do not trust Applebee's to have proper security hygiene.

      No doubt they are using someone else to provide everything, and no doubt it's a large number of someone elses who are involved. It's outsourcing all the way down.

    • Personally, I don't even trust Applebee's to have proper food hygiene.

  • Try our new hash stuffed appetizers.

    • Try our new hash stuffed appetizers.

      Yeah, I suspect the only place Applebee's does any hashing is in their kitchens. Their IT staff be like "Wut"?

  • If you think that poor hygiene applies just to Applebee's data handling, have a look in their kitchens.

  • If you forget to hide the keys
    Hackers will get in Applebees
    Make off with customer IDs
    And throw up on their credit scores

  • Dammitall (Score:5, Funny)

    by ebunga ( 95613 ) on Thursday November 05, 2026 @09:04PM (#66412455)

    Now people are going to know just how much I love the quesadilla cheeseburger.

  • For these 'rewards' apps, when you sign up, there should be a box requesting a numeric value.

    And there you enter how much compensation you get in your local currency if/when a data breach occurs.

    If they don't like your amount, then the app doesn't load. Otherwise, when they mess up, you get your compensation. Make this required by law.

    Problem solved. Maybe they'll take this shit more seriously then. And if they don't, at least I get a fair payout.

    • The fair payout is the one both sides can agree upon, not that which one side wants.

      • Yeah, I address that, did you even read what I wrote?

        And just who are you? Someone who creates insecure apps?

      • The fair payout is the one both sides can agree upon, not that which one side wants.

        I'll bite!

        Data security, and penalties for not taking it seriously enough, should be a matter of legislation rather than deal-making. So the "fair payout" should be prescribed by law, not by agreement between a weasel-word-spouting corporation and a possibly-unaware technically-challenged rube.

  • This is a bug so old it died and they had to reanimate it to even be able to put it in there. Crap like this happens when the developers are clowns (or "AI") and have no clue at all about IT security. And when there is no liability even when the most basic and most gross mistakes are made.

  • We had a technology called the internet which was great for accessing databases, authenticating users and the like. It even ran without needing some abortion of a proprietary, not sufficiently maintained piece of shit app.

  • Now we know who the Applebees enthusiasts are. We can sign them up for the B Ark.

    • It's a decent value and there's no line because the company is falling apart. Frugality puts one on the B Ark?
  • its been compromised. I don't do crap like food apps, but I still assume my ss, birthdate, address, phone, ... have all been compromised. There have been so many hacks how can you assume anything else? I have the IRS PIN for my tax return, credit freezes at all credit agencies, freeze on my phone num, ... If it can freeze, its frozen. My bank and cc notifications get triggered on the price of a meal at fast food.

    As to logs, even if they have them, do they have them far enough back in time? I doubt anyone ke

  • This is why I only ever eat at Wingstop, they use 2FA. (No really, they do: https://www.pasteboard.co/f4gi... [pasteboard.co])

  • Guess they don't know about secrets scanning in buikd pipelines. No DevSecOps at Applebee's I guess.

Slashdot Top Deals

No man is an island if he's on at least one mailing list.

Close