Hotel and resort giant Wyndham acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug allowing access to customers' personal information. Security researcher Robert Wiggins at What Security told TechCrunch he found a password embedded in the source code of Wyndham's Android app. The password granted access to an internal company database hosted by Salesforce.
Wiggins told TechCrunch the credential exposed personal information including customer names, email addresses, and Wyndham member numbers. The database also stores customer login tokens called JWTs that keep customers logged into their apps without repeatedly entering passwords. The database additionally contained Wyndham files and documents.
According to Wiggins the database contained millions of entries though he could not determine an accurate number of exposed customer records. Wyndham touts 129 million enrolled rewards members. The researcher said Wyndham has no way to report security flaws and asked TechCrunch's help in alerting the company. Soon after TechCrunch made contact with Wyndham's cybersecurity staff the exposed credential was revoked preventing further access to the database.
A Wyndham spokesperson told TechCrunch "Our team has taken steps to address the issue." The statement added "Our security teams have no evidence of any unauthorized access" without providing further details. Wyndham's spokesperson would not say whether the company had technical means such as server logs to determine if anyone had access to the customer database prior to Wiggins' discovery.
TechCrunch also asked Wyndham whether it planned to notify customers whose information was exposed or disclose the incident to U.S. regulators such as filing a notice with the Securities and Exchange Commission as public companies are required to do for material cybersecurity incidents. Wyndham would not say. The spokesperson also would not say for how long the password was embedded in the customer app or how Wyndham plans to ship a long-term fix for the app.
App and software developers generally avoid including passwords or credentials in publicly released software and apps a process known as hardcoding as anyone with a copy of the software can extract the password and use it to access its associated server or database. Given the simplicity with which credentials can be abused many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating.
For Wiggins this is his second public discovery of hardcoded credentials in two weeks after finding a near-identical vulnerability in Applebee's app that exposed customer data. Wiggins relied on AI tools for both discoveries which make it easier to identify simple security weaknesses such as hardcoded credentials by scouring thousands of lines of decompiled app code every second.
When asked about Wyndham's response Wiggins told TechCrunch he was glad the company fixed the issue but noted without visibility into any past activity someone with malicious intent could have leaked large amounts of customers' personal information. The company would not say whether it planned to set up a vulnerability disclosure program to allow outside security researchers and hackers to privately report security vulnerabilities.
Michael Francess Wyndham's cybersecurity director who responded to the incident told TechCrunch researchers can alert security@wyndham.com with details of potential security issues. The company's spokesperson would not say whether it plans to change its website to allow researchers to alert the company.
This is the latest known security incident at Wyndham in recent years. In 2024 a security researcher found several Wyndham hotel check-in desks were running remote-access spyware that was leaking screenshots of guest records and booking information to the open web. Soon after reporting the spyware app called pcTattletale was hacked and its banks of customer data stolen forcing the company's owner Bryan Fleming to shut down the company. Fleming a former resident of Michigan was later arrested by federal authorities and convicted of making selling and advertising unlawful spyware.
Hardcoded credential in Wyndham's Android app
Security researcher Robert Wiggins discovered a password stored directly in Wyndham's Android application source code. The credential provided entry to an internal company database hosted by Salesforce. Wiggins extracted the password by decompiling the app binary and finding the secret embedded in the code. This practice known as hardcoding means anyone who obtains a copy of the application can extract the credential and use it to access the associated database.
Data exposed through the database
The database contained personal information including customer names email addresses and Wyndham member numbers. It also stored JWT tokens used for persistent login sessions within the mobile application. Beyond customer records the database held internal Wyndham files and documents. Wiggins reported the database held millions of entries though he could not quantify the exact number of exposed customer records. Wyndham reports 129 million enrolled rewards members.
Researcher's discovery method and prior finding
Wiggins used AI-assisted tools to scan decompiled application code searching for embedded credentials. The same approach revealed a nearly identical hardcoded password in Applebee's app two weeks earlier. AI tools can process thousands of lines of code per second identifying simple security weaknesses such as passwords stored in plain text. Wiggins noted this was his second public disclosure of this type of vulnerability within a short period.
Wyndham's response and unanswered questions
After TechCrunch contacted Wyndham's cybersecurity team the exposed credential was revoked. A company spokesperson stated the security team has no evidence of unauthorized access though the statement did not provide technical details or logs supporting that claim. Wyndham declined to confirm whether server logs or other monitoring tools exist to investigate prior access to the database.
The company also refused to say whether it intends to notify affected customers or file required disclosures with U.S. regulators. When asked about long-term remediation the spokesperson declined to specify how the fix will be delivered or how long the credential remained embedded in the application. Wyndham has not confirmed plans to establish a formal vulnerability disclosure program for outside researchers.
Michael Francess Wyndham's cybersecurity director confirmed researchers may contact security@wyndham.com to report potential issues. However the company's public website does not currently list a dedicated channel for security researchers according to follow-up questions from TechCrunch.
Broader context of Wyndham security incidents
This incident follows a separate security event in 2024 when a researcher found Wyndham hotel check-in desks running remote-access spyware. The spyware called pcTattletale was leaking screenshots of guest records and booking information to the open web. After TechCrunch's reporting the pcTattletale application was itself hacked and customer data was stolen. The company's owner Bryan Fleming was later arrested convicted of producing and distributing unlawful spyware.