Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a security researcher discovered a hardcoded password in its Android app that exposed customer personal information, including names, email addresses, and login tokens.
Security researcher Robert Wiggins of What Security found the credential in the source code of Wyndham’s app, which granted access to an internal company database hosted by Salesforce. The database contained customer names, email addresses, Wyndham member numbers, and login tokens that keep users logged into their apps. Wiggins told TechCrunch the database had millions of entries, but he could not determine the exact number of exposed records. Wyndham touts some 129 million enrolled rewards members.
The researcher said Wyndham had no way to report security flaws and asked TechCrunch to help alert the company. After TechCrunch contacted Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing further access.
Wyndham’s spokesperson told TechCrunch: “Our team has taken steps to address the issue.” The statement added: “Our security teams have no evidence of any unauthorized access.” However, Wyndham would not say whether it has the means to determine if anyone accessed the database before the discovery, whether it plans to notify customers, or whether it plans to disclose the incident to U.S. regulators. The company also would not say how long the password was embedded in the app or how it plans to provide a long-term fix.
Hardcoding credentials in publicly released software is a known security risk, as anyone with a copy of the software can extract and use the password. Wiggins relied on AI tools for this discovery, which allow him to quickly scan thousands of lines of decompiled app code for such weaknesses.
This is the latest known security incident at Wyndham in recent years. In 2024, a researcher found that several Wyndham hotel check-in desks were running spyware that was leaking screenshots of guest records and booking information to the open web.
When asked about the response, Wiggins told TechCrunch he was glad the company fixed the issue but noted that without visibility into past activity, someone with malicious intent could have leaked large amounts of customer information. Wyndham’s cybersecurity director, Michael Francess, told TechCrunch that researchers can alert [email protected] with details of potential security issues.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedA Wyndham spokesperson said, “Our team has taken steps to address the issue.”TechCrunch: ““Our team has taken steps to address the issue,” a Wyndham spokesperson told TechCrunch.”
- SupportedWyndham’s statement said, “Our security teams have no evidence of any unauthorized access.”TechCrunch: ““Our security teams have no evidence of any unauthorized access,” the statement added, without providing any further details about the claim.”
- SupportedWyndham exposed customer data after an app security lapse.TechCrunch: “Hotel giant Wyndham exposed customer data after app security lapse.”
- SupportedWyndham acknowledged a cybersecurity incident after a researcher discovered a bug that exposed customers’ personal information.TechCrunch: “Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers’ personal information.”
- SupportedRobert Wiggins of What Security found a password in Wyndham’s Android app source code that granted access to an internal database hosted by Salesforce.TechCrunch: “Security researcher Robert Wiggins at What Security exclusively told TechCrunch that he found a password inside the source code of Wyndham’s Android app, which granted access to an internal company database, hosted by tech company Salesforce.”
- SupportedThe database contained customer names, email addresses, Wyndham member numbers and login tokens.TechCrunch: “Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses, and Wyndham member number. The database also stores customer login tokens ( called JWTs ) that keep customers logged-in to their apps without having to repeatedly enter their own passwords.”
- SupportedThe database had millions of entries, but Wiggins could not determine the exact number of exposed customer records.TechCrunch: “According to Wiggins, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records.”
- SupportedWyndham touts about 129 million enrolled rewards members.TechCrunch: “Wyndham touts some 129 million enrolled rewards members.”
- SupportedThe researcher said Wyndham had no way to report security flaws and asked TechCrunch to help alert the company.TechCrunch: “The researcher said Wyndham has no way to report security flaws, and asked for TechCrunch’s help in alerting the company.”
- SupportedAfter TechCrunch contacted Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing further access to the database.TechCrunch: “Soon after TechCrunch made contact with Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing any further access to the database.”
- SupportedWyndham would not say whether it had the technical means to determine if anyone accessed the database before Wiggins’ discovery.TechCrunch: “Wyndham’s spokesperson would not say, when asked, whether the company had the technical means, such as server logs, to determine if anyone had access to the customer database prior to Wiggins’ discovery.”
- SupportedWyndham would not say whether it planned to notify affected customers or disclose the incident to U.S. regulators.TechCrunch: “TechCrunch also asked Wyndham whether it planned to notify customers whose information was exposed, or disclose the incident to U.S. regulators, such as filing notice with the U.S. Securities and Exchange Commission, as public companies are required to do for material cybersecurity incidents. Wyndham would not say.”
