Applebee's Data Breach: What Was Exposed

A woman in Ohio joined Applebee’s Rewards for a free appetizer. This month, anyone who downloaded the chain’s Android app could have pulled her name, her email address, her birth date, her phone number and her ZIP code. The same records gave up the IP address of her last sign-in. The Applebee’s data breach did not need a hacker. It needed a text editor.

Confirmation: confirmed by the company — Dine Brands told TechCrunch that its security team investigated and that the flaw has been fixed, while saying it has not found evidence of unauthorized access.

What happened in the Applebee’s data breach

U.K. security researcher Robert Wiggins found the password to an internal Applebee’s database. It sat in plain text inside the chain’s Android app, which has more than a million downloads on Google Play. So anyone who decompiled that app could read the password and sign in to the remote system. Wiggins also told TechCrunch that the same access could have let someone change customer records.

Wiggins could not report it directly. Neither Applebee’s nor its parent Dine Brands publishes a way to report a security issue. So he asked TechCrunch for help. TechCrunch decompiled the app, then created an account with dummy data, then watched Wiggins retrieve that data. Applebee’s confirmed on Thursday, October 29 that it had closed the hole. The story ran Friday, October 30.

The victim count is still not public. Dine Brands would not give one. For scale, Applebee’s reported at least 8.5 million enrolled rewards members last year. But membership is not a victim count, and nobody has offered one. The company also would not say how long that password sat in the app. It would not say whether it keeps server logs that could show who else used it.

What the Applebee’s data breach exposed, and what each piece is worth

TechCrunch lists the fields as names, email addresses, birth dates, phone numbers and ZIP codes. Each record also flags whether the customer verified that email address. It carries veteran status, login counts, account creation dates and the IP address of the most recent sign-in.

That combination helps a scammer a great deal. A verified-email flag tells someone which inbox a person actually reads. A birth date and a ZIP code answer two of the three questions a call center asks to confirm identity. A phone number invites text scams. A recent login IP narrows down the city. Veteran status should worry people most, because benefits fraud and charity fraud target veterans directly. A list that labels them is a targeting list.

The follow-up email is the real risk

Nothing here opens your Applebee’s account. The leak held no password for it. But the next email is the danger, and it will look right. It will arrive as Applebee’s Rewards. It will greet you by your real first name. It may name the month you joined. Then it will ask you to confirm your account, or to claim points before they expire.

That is how a breach at a restaurant empties a bank account somewhere else. The Applebee’s data breach is the research. The email is the attack.

What to do now

Treat every message about your rewards account as unverified for the next few months. Then open the app yourself instead of tapping a link. If points really are waiting, the app will show them.

Put a password manager on every account that still has a password. Give each account a different one. Then turn on the strongest sign-in each service offers: a passkey where it exists, an authenticator app where it does not, and text codes as a last resort.

Your birth date now circulates, so add a verbal password or PIN where a service allows one. Your phone carrier and your bank matter most here. Also freeze your credit with all three bureaus. It costs nothing, and it blocks the use these records serve best.

If you are a veteran, expect pitches about benefits, discounts and charities. In short: a real benefits office does not call you first and ask for your Social Security number.

How OptMsg changes this exposure

The breach happened at Applebee’s, and no inbox would have changed that. What an inbox changes is what comes next, and most of the damage lands there.

Two things are true about OptMsg, and both stay narrow on purpose. First, an OptMsg account has no password. So a password leaked from some other site cannot open your inbox. Credential stuffing needs a password to try, and your OptMsg account does not have one. Second, mail from a sender you have not approved goes to Trash rather than your Inbox, and Trash auto-deletes after 30 days. The follow-up phish wearing the Applebee’s Rewards name is exactly that kind of mail.

Be clear about what the argument leaves out. It does not protect a compromised device. It does not stop you from typing your details into a live phishing page. It does nothing about an attacker holding your unlocked phone. It cannot undo the records someone already took. What it does is shut the door that stolen address knocks on.

If a quieter inbox sounds like the right answer to a year of other companies’ breaches, you can create an account and forward your existing mail to it.

Create Your Account

Your Inbox. Your Rules.

Frequently asked questions

Did the Applebee’s data breach leak my account password? No. The leaked database held profile information, not your password. The password at issue belonged to Applebee’s own database, and it sat inside the chain’s Android app.

How many people did it affect? That number is still not public. Dine Brands has not given one, and TechCrunch reports the count is unclear. Applebee’s had at least 8.5 million enrolled rewards members as of last year, but membership is not the same as a confirmed victim count.

Is the problem fixed? Yes. Applebee’s confirmed on October 29, 2026 that it had closed the access, and TechCrunch held the story until Applebee’s confirmed that fix. The company’s investigation continues.

Will Applebee’s notify me? It has not said. The company did not answer when TechCrunch asked whether it would alert customers or regulators. So do not wait for a letter before you change how you treat email about your rewards account.

What is the single most useful thing to do today? Freeze your credit, and stop trusting links in rewards email. Both cost nothing, and together they cover the two ways scammers use this data.