Applebee’s and Northflank disclose separate security breaches

Applebee’s has patched a critical security vulnerability in its Android mobile application after a researcher discovered a hardcoded database password within the source code. The flaw, identified by Robert Wiggins of What Security using AI tools, potentially allowed unauthorized access to a database containing the personal information of millions of customers. Exposed data includes names, email addresses, dates of birth, phone numbers, ZIP codes, IP addresses, and veteran status. While the parent company, Dine Brands, has addressed the issue, it has not confirmed if the data was exploited or how many users were affected.

Separately, cloud hosting platform Northflank reported a security breach on October 30 that led to the unauthorized use of customers’ AI API keys. Following a threat alert from security firm Wiz, Northflank advised all customers to assume their environment variables had been decrypted and to rotate all credentials immediately. The incident is part of a broader trend labeled “Black October” by Wiz, which documented at least nine security incidents affecting various AI developer platforms throughout the month.