Wyndham confirms it exposed hotel customer data after expert finds flaw in app security
Login tokens were also exposed by Wyndham’s Android app.
Wyndham Hotels & Resorts, a leading hotel chain, has admitted to a cybersecurity incident that exposed sensitive customer data and login tokens through a flaw in its Android app. Researchers discovered the issue after an independent security analyst found hardcoded credentials embedded in the app's code, which granted access to millions of records including names, emails, member IDs, and authentication tokens.
Wyndham fixed the problem following disclosure, but the exact scope of the breach and any prior unauthorized access remain unclear. The hotel confirmed the issue to TechCrunch, stating that its security teams had no evidence of unauthorized access. However, the lack of transparency around the incident leaves many questions unanswered, such as the number of individuals affected and the duration of the exposure.
This is the second instance of hardcoded credentials found by security researcher Robert Wiggins in just two weeks, with a similar incident recently discovered in an Android app belonging to Applebee's, another casual dining restaurant chain.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
