Hotel giant Wyndham exposes customer data through app security flaw

Hotel and resort company Wyndham has acknowledged a cybersecurity incident involving its Android app. Security researcher Robert Wiggins of What Security told TechCrunch that he found a password inside the app's source code that gave access to an internal company database hosted by technology company Salesforce.

What was exposed

According to Wiggins, the credential revealed customer names, email addresses and Wyndham member numbers. The database also held login tokens (JWTs), which keep users signed in to the app without re-entering a password, along with company files and documents. It contained millions of entries, though he could not determine an exact number of affected records. Wyndham says it has about 129 million enrolled rewards members.

The researcher said Wyndham offers no way to report security flaws, so he asked TechCrunch to help alert the company. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the credential was revoked and access to the database ended.

The company's response

A Wyndham spokesperson said the team had taken steps to address the issue and that its security teams had no evidence of unauthorized access, without giving further details. The company did not say whether it can tell, for example from server logs, if anyone accessed the database before the discovery. It also would not say whether it will notify affected customers or report the incident to U.S. regulators such as the Securities and Exchange Commission, which requires public companies to disclose material cybersecurity incidents. Nor did it say how long the password had been in the app or how a long-term fix would be delivered.

Michael Francess, Wyndham's cybersecurity director, said researchers can report potential issues to a designated email address. The company did not say whether it plans to set up a formal vulnerability disclosure program.

Wider context

Embedding passwords in publicly released apps, known as "hardcoding", is generally avoided because anyone with a copy of the app can extract the credential and use it to reach the associated server or database. Such cases often receive the maximum severity rating. This is Wiggins' second such discovery in two weeks, after a near-identical flaw in the Applebee's restaurant chain's app. He used AI tools in both cases.

It is not Wyndham's first incident. In 2024, a researcher found that spyware called pcTattletale, running on several Wyndham hotel check-in computers, was leaking screenshots of guest records. The spyware was later hacked and its owner, Bryan Fleming, shut the company down. He was later convicted of making, selling and advertising unlawful spyware.