A Password in the Wrong Place Can Expose an Entire Business

Most businesses know passwords need to be strong. Employees are told not to reuse them, multi-factor authentication is becoming standard, and password managers are increasingly common. But business password security has another problem that’s much harder to see:

What happens when a password is stored somewhere it never should have been?

A recent security issue involving Applebee’s is a powerful example.

What Happened at Applebee’s

According to a report from TechCrunch, a security researcher discovered a credential for an internal database embedded in Applebee’s Android app. The credential could be extracted from the app and used to access the company’s customer database.

The affected database reportedly contained customer names, email addresses, dates of birth, phone numbers, ZIP codes and recent login IP addresses, and the researcher said the credential could potentially have been used to change customer data. Applebee’s parent company, Dine Brands, told TechCrunch it had addressed the issue and that its investigation, which was ongoing, had not found evidence of unauthorized access.

The lesson for every business is simple: cybersecurity isn’t just about creating stronger passwords. It’s about controlling where credentials exist, who can use them, and what happens if one is compromised.

The Problem With Hardcoded Passwords

Embedding a password, API key, database credential or other secret directly in software is called hardcoding credentials. In this case, TechCrunch reported the credential was buried in thousands of lines of the app’s code, and the researcher used AI to help find it.

A password doesn’t have to sit in a document labeled “PASSWORDS” to be exposed. Credentials find their way into:

• Applications and scripts
• Configuration files and source code
• Automation processes
• Documentation and shared folders
• Old employee accounts
• Service accounts
• Cloud applications

That’s why password security has to be part of a broader identity and access security strategy.

Strong Passwords Aren’t Enough

Imagine a company creates an incredibly complex, 30-character database password. If that password is embedded in an app anyone can download and inspect, its complexity offers little protection once it’s found. It’s like installing an expensive lock and leaving the key where anyone can reach it. A strong business password security program goes further:

1. Use Multi-Factor Authentication

Wherever it’s supported, protect sensitive business accounts with multi-factor authentication (MFA). It adds a verification step beyond the password, and it’s especially important for cloud services and administrator accounts. But MFA isn’t the whole solution: application credentials, service accounts, tokens and database connections work differently from an employee signing in to Microsoft 365, and they need their own controls.

2. Stop Sharing Passwords

Shared administrator logins and password spreadsheets create unnecessary risk. Where possible, give each person their own account, so access can be controlled and activity traced to a specific person. And have a clear process for removing access when employees, vendors or contractors no longer need it.

3. Use a Business Password Manager

Employees shouldn’t have to remember dozens of complex passwords. A business password manager generates and securely stores unique credentials, instead of encouraging predictable or reused passwords. Your IT team should also know how administrator credentials, service accounts and other privileged secrets are managed.

Protect Privileged Credentials Differently

Not every password carries the same risk. A login for a low-risk app and a credential that opens your customer database shouldn’t get the same level of protection. Identify the credentials that provide access to:

• Microsoft 365 administration and Microsoft Entra ID
• Servers, firewalls and network equipment
• Backup platforms
• Financial applications
• Customer databases
• Remote access systems
• Cloud environments and business-critical applications

These privileged credentials deserve stronger controls, tighter access, regular review and monitoring. Learn how Microsoft Entra ID helps protect administrator accounts.

Monitor Identity, Not Just Devices

Traditional cybersecurity focused on protecting the computer. Today, attackers increasingly target the identity behind it. A stolen credential can give an attacker access to email, cloud apps and company data without ever installing malware on an employee’s computer.

That’s why TCI recommends a layered approach. Endpoint detection and response (EDR) protects computers and servers, while identity threat detection and response (ITDR) watches for suspicious activity involving user accounts and credentials. The goal isn’t to replace MFA, endpoint security, email filtering or training. It’s making sure your business doesn’t depend on one control to stop every attack. See how TCI provides 24/7 security monitoring across endpoints and identities.

Developers and Applications Need Password Security Too

The Applebee’s story highlights something easy to overlook: cybersecurity isn’t only an IT department problem. If your organization builds applications or connects cloud platforms, passwords, database credentials and API keys shouldn’t be embedded in software just because it’s convenient. Secure development should include secrets management, access control, code review, vulnerability testing and logging.

Interestingly, the researcher reportedly had trouble notifying Applebee’s or Dine Brands, because neither offered a way to report security issues, and eventually turned to TechCrunch for help. That’s another lesson: have a plan for receiving security reports, not just for preventing incidents.

AI Changes the Password Conversation

The researcher said AI helped find the exposed credential in thousands of lines of code. AI is a valuable security tool, but that same ability to analyze huge amounts of information quickly means you should assume exposed credentials and security mistakes can be found faster than ever.

In other words, security through obscurity is becoming even less effective. Don’t assume a password buried deep in code, documentation or configuration files is safe just because it would be hard for a person to find.

7 Business Password Security Questions to Ask

1. Do all employees use unique passwords for business systems?
2. Is MFA turned on everywhere it’s practical and supported?
3. Are administrator accounts separate from everyday user accounts?
4. Are passwords being shared by email, spreadsheets, documents or Teams messages?
5. Do we know which service accounts and application credentials exist?
6. Are former employee and vendor accounts reviewed and removed promptly?
7. Can we detect suspicious account and sign-in activity?

If the answer to several of these is “we’re not sure,” that’s a cybersecurity issue worth investigating.

Password Security Is Really Identity Security

Passwords aren’t disappearing overnight. But business password security means more than adding another symbol every few months. It’s about understanding who has access, what they can access, how they sign in, where credentials are stored, whether a compromised credential can be detected, and how quickly access can be revoked.

The Applebee’s incident is a reminder that one poorly protected credential can undermine several other security controls. At TCI Technologies, we help businesses take a layered approach to cybersecurity, including identity security, Microsoft 365 security, endpoint protection, email and phishing protection, vulnerability management and security awareness.

Concerned about passwords, Microsoft 365 security or identity protection in your organization? Take our free Cybersecurity Risk Assessment to uncover gaps before they become incidents, or call us at (516) 484-5151.