Hotel giant Wyndham exposed customer data after app security lapse

Summary

• Wyndham acknowledged a cybersecurity incident after researcher Robert Wiggins discovered a password hardcoded in the source code of its Android app.
• The exposed credential granted access to an internal Salesforce-hosted database containing customer names, email addresses, Wyndham member numbers, login tokens, and company files.
• The database held millions of entries, though the exact number of exposed records could not be determined.
• Wyndham revoked the exposed credential shortly after TechCrunch contacted its cybersecurity staff, preventing further access.
• A Wyndham spokesperson stated there is no evidence of unauthorized access but did not confirm if server logs exist to verify past activity.
• The company declined to specify how long the password remained in the app, whether it plans to notify customers or regulators, or if it will implement a long-term fix.
• Wyndham did not confirm if it plans to establish a formal vulnerability disclosure program for external researchers.
• Michael Francess, Wyndham's cybersecurity director, directed researchers to report issues via email to [email protected].
• This incident follows a 2024 breach where spyware on hotel check-in desks leaked guest data, leading to the arrest and conviction of the spyware's creator.
• Wiggins used AI tools to identify the hardcoded credentials, marking his second such discovery in two weeks.