Image: Wikimedia Commons, CC BY 4.0 — A Wyndham Garden hotel. The exposure came through the Wyndham app, not the hotels themselves.
📌 Key Highlights
- Security researcher Robert Wiggins of What Security found the password hardcoded in the source code of Wyndham's Android app.
- The password opened an internal Salesforce-hosted database holding millions of entries; the exact number of exposed records is unknown.
- Exposed data included names, email addresses and Wyndham member numbers, plus login tokens (JWTs) and internal files and documents.
- Wyndham revoked the credential after TechCrunch alerted it, but would not say how long the password was in the app, whether it can check for past access, or whether it will notify customers or regulators.
What happened?
On 9 November 2026, TechCrunch reported that researcher Robert Wiggins had found a password embedded in the source code of Wyndham's Android app. The password granted access to an internal company database hosted by Salesforce — and anyone with a copy of the app could have extracted it.
The database contained millions of entries, though Wiggins could not determine an exact number of exposed customer records. For scale, Wyndham counts some 129 million enrolled rewards members. The database also stored login tokens — JWTs — that keep customers signed in without repeatedly entering their passwords. Wiggins found Wyndham had no clear way to report security flaws, so he asked TechCrunch for help; soon after TechCrunch contacted Wyndham's cybersecurity staff, the credential was revoked.
What data was exposed?
| Data | What it means |
|---|---|
| Customer names | Full names stored in the internal database |
| Email addresses | Usable for phishing emails impersonating Wyndham |
| Wyndham member numbers | Rewards membership identifiers |
| Login tokens (JWTs) | Tokens that keep customers signed in — these can let an attacker act as the customer without a password |
| Internal files and documents | Wyndham files stored in the same database |
No payment-card data was reported as exposed in the disclosure.
Image: Wikimedia Commons, CC0 — A Wyndham resort hotel. Wyndham is one of the world's largest hotel companies, with around 129 million rewards members.
Why it matters
Developers are supposed to keep passwords out of publicly released software: anyone with a copy of the app can extract a hardcoded credential and use it. Because such flaws are so easy to abuse, many are given the maximum vulnerability severity rating. The login tokens make this worse than a name-and-email leak — a stolen token can keep an attacker signed in as a customer without ever knowing the password.
The biggest unknown is time. Wyndham has not said how long the password sat in its app, so nobody outside the company can say how long the database was reachable, or whether anyone used the password before Wiggins found it. It is Wiggins' second such discovery in two weeks, after a near-identical flaw in Applebee's app — found with AI tools that scan thousands of lines of decompiled app code in seconds.
What Wyndham has — and hasn't — said
Wyndham acknowledged the incident to TechCrunch. "Our team has taken steps to address the issue," a spokesperson said. "Our security teams have no evidence of any unauthorized access." But the company declined to say whether it even has the technical means, such as server logs, to tell if anyone accessed the database before Wiggins' discovery, how long the password was in the app, or how it plans to ship a long-term fix. It also would not say whether it will notify affected customers or disclose the incident to US regulators, as public companies must for material cybersecurity incidents. Michael Francess, Wyndham's cybersecurity director, told TechCrunch researchers can report issues to security@wyndham.com. In 2024, a researcher found several Wyndham hotel check-in desks running spyware that leaked guest records to the open web.
Should you care?
What guests should do now
- Change your Wyndham password now — and do not reuse that password anywhere else.
- Sign out of the Wyndham app on all devices and sign back in, so any old login token is replaced.
- Watch for phishing — emails or texts using your name and Wyndham member number to pose as the hotel chain.
- Check your bookings and rewards balance for anything you do not recognise, and turn on any extra sign-in protection the app offers.
FAQs
Has my data definitely been stolen?
Not confirmed. Wyndham says it has no evidence of unauthorised access — but it also would not say whether it can check. Until the company can rule it out, treat your name, email and member number as exposed.
Were credit-card details exposed?
No payment-card data was reported as exposed. The reported exposure covers names, email addresses, member numbers, login tokens and internal files.
I only stayed at a Wyndham hotel — am I affected?
The exposure was through the app's database, which holds customer records including rewards members. If you have a Wyndham Rewards account or have used the Wyndham app, assume your details were in scope and change your password.
Is the app safe to use now?
The exposed credential has been revoked, so that route into the database is closed. Still change your password and sign in fresh, and keep an eye out for phishing using your Wyndham details.
Takeaway
A single password left in a public app put millions of hotel guests' details within anyone's reach — and Wyndham still cannot say whether anyone took them. The fix is closed; your part is a two-minute password change.
If you stayed at a Wyndham hotel recently, check your rewards account today — and if you use the same password anywhere else, change it there too. For the wider pattern, read our coverage of the Fireworks AI data breach and the Qubole AWS breach; for a similar Indian case, see the SBI customer data leak.
Sources
- TechCrunch — "Hotel giant Wyndham exposed customer data after app security lapse" (9 Nov 2026) — exclusive report; includes Wyndham's statement and researcher Robert Wiggins' findings.
- What Security — security researcher Robert Wiggins' firm, which discovered the hardcoded credential.
Comments
Post a Comment