Applebee's Data Exposure: What Club Members Should Do Now

If you have an Applebee's rewards account, your birth date and phone number may have been sitting behind a password anyone could pull out of the chain's Android app. The Applebee's data exposure, first reported by TechCrunch, has been fixed, and the company says it has found no evidence anyone misused it. Still, a few cheap steps now can protect you if that changes.

A database password hidden in the Android app

UK security researcher Robert Wiggins of What Security found the problem in October. He used AI tools to search thousands of lines of code in the Applebee's Android app, which has more than a million downloads on Google Play, and spotted a credential for an internal customer database written directly into the app.

That kind of mistake is serious because anyone who downloads an app can take it apart. Whoever found the password could log in to the database, and Wiggins told TechCrunch it might also have allowed someone to change customer records.

TechCrunch says it confirmed the flaw by decompiling the app, creating an Applebee's account filled with dummy data, and then watching Wiggins pull that dummy data back out of the database.

Wiggins could not find any way to report the bug to Applebee's or its parent company, Dine Brands, so he asked TechCrunch for help reaching them. Applebee's confirmed on October 29 that it had fixed the issue, and TechCrunch held its story until then.

Which Club Applebee's details were reachable

According to TechCrunch, the database held these fields for customers:

• Full names and email addresses, plus whether the email was verified
• Dates of birth and phone numbers
• ZIP codes and veteran status
• Account creation dates and how many times the user logged in
• The IP address of the most recent login, which can hint at a rough location

There is no sign that passwords or payment card numbers were part of the exposed data, based on the fields TechCrunch listed.

How many people were affected is unknown. Applebee's would not give a number, and Wiggins said counting would mean opening possibly every record. For scale, Dine Brands CEO John Peyton said in 2025 that the Club Applebee's program had about 8.5 million members, CX Dive reported.

What Dine Brands has and has not said

A Dine Brands spokesperson told TechCrunch the company's security team opened an investigation right away and has not found evidence of unauthorized access so far. The investigation is still going.

Several questions remain open. The spokesperson would not say whether the company keeps logs that could show who accessed the database. TechCrunch also asked whether Applebee's will notify customers or regulators, and how long the password was in the app, and it did not report answers to those questions.

That gap matters. "No evidence" is only as strong as the records a company keeps. Without logs, it is hard to know either way.

Five steps for Applebee's rewards members this week

The exposed details are exactly what scammers use to sound legitimate: your name, birthday, phone number and the fact that you are a customer. Here is what is worth doing now.

1. Watch for fake Applebee's messages. Be suspicious of texts or emails offering free meals, rewards or refunds that ask you to log in or "confirm" details. Our guide on how to spot a scam email covers the warning signs, and this explainer on phishing shows how these lures work.
2. Treat your birth date as known. Many banks and phone carriers use birth date as a security check. Ask them to add a PIN or passphrase to your account instead.
3. Change your Applebee's password if you reused it elsewhere. Passwords were not listed as exposed, but reuse is the habit that turns a small leak into a big one.
4. Consider a credit freeze. It costs nothing and blocks new accounts in your name. Here is how to freeze your credit at all three bureaus.
5. Know what to do if something looks wrong. If you spot accounts you did not open, follow our identity theft checklist.

Will Applebee's customers get a notice or a payout?

That depends on what the investigation finds. Breach notice laws in most states turn on whether data was actually accessed and which fields were involved, and birth dates and phone numbers alone do not always trigger them. Payouts usually come only from class action settlements after a confirmed breach, as with the AT&T settlement, which has taken roughly two years to pay out.

For now, the most useful thing you can do is assume your contact details are in circulation and slow down before clicking any message that uses them. More security coverage lives in our tech section.