Hotel giant Wyndham exposed customer data after app security lapse
Exclusive: Wyndham left a hardcoded credential in its customer app, allowing anyone to access customer data. The hotel giant wouldn't say if it has the ability to check for any past unauthorized access.
Hotel and resort company Wyndham has acknowledged a cybersecurity incident after a security researcher discovered a bug that allowed anyone to access customers’ personal information. Robert Wiggins, a security researcher from What Security, found a password in the source code of Wyndham’s Android app. This password granted access to an internal company database hosted by Salesforce.
The database, which contained millions of entries, included customer names, email addresses, and Wyndham member numbers. It also stored customer login tokens, which keep customers logged into their apps without repeatedly entering passwords. Wyndham has 129 million enrolled rewards members. The researcher reported the issue to TechCrunch after Wyndham did not have a process for reporting security flaws.
Wyndham stated that they had revoked the exposed credential, and they had no evidence of unauthorized access, but they did not say whether they could determine if anyone had accessed the database before Wiggins' discovery. The spokesperson also declined to comment on whether they had the technical means to detect unauthorized access, whether they would notify customers or regulators about the incident, and how long the password had been embedded in the app.
This is the latest known security incident at Wyndham, with a similar case in 2024 involving remote-access spyware found on hotel check-in desks.
Written by urgent.news from TechCrunch's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
