Hotel giant Wyndham exposed customer data after app security lapse

The article has to stay inside the TechCrunch facts and the five-section shape, so I am drafting it and checking paragraph length, deck length, and that every name and figure comes from the source.A few paragraphs ran long or added wording the source does not support. I am tightening those so every sentence stays on the reported facts.Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers' personal information, according to TechCrunch's report.

Robert Wiggins at What Security exclusively told TechCrunch that he found a password inside the source code of Wyndham's Android app, and that this credential granted access to an internal company database hosted by Salesforce. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked.

This piece sets out the customer fields stored in that database, the revocation that followed TechCrunch's contact with Wyndham, and the questions the company would not answer on logs, customer notice, regulators, and a long-term app fix. It is for Wyndham rewards members whose names, emails, member numbers, and login tokens were in the database, and for developers and security teams who ship public apps or receive outside vulnerability reports. It also records Wiggins' second hardcoded-credential discovery in two weeks and a 2024 spyware incident on Wyndham hotel check-in desks.

01Android password and customer records

Wiggins found the password in the source code of Wyndham's Android app, and the credential granted access to an internal company database hosted by tech company Salesforce. He told TechCrunch that the bug allowed anyone to access customers' personal information. The hotel group has acknowledged the cybersecurity incident.

The credential exposed personal information including customer names, email addresses, and Wyndham member numbers. The same database stores customer login tokens, called JWTs, that keep customers logged in to their apps without having to repeatedly enter their own passwords. It also contained Wyndham files and documents.

According to security researcher Robert Wiggins at What Security, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records in that Salesforce database. Wyndham touts some 129 million enrolled rewards members.

02Revoked credential after staff contact

The researcher said Wyndham has no way to report security flaws, and he asked for TechCrunch's help in alerting the company. Soon after TechCrunch made contact with Wyndham's cybersecurity staff, the exposed credential was revoked. The revocation prevented any further access to the database.

A Wyndham spokesperson told TechCrunch, "Our team has taken steps to address the issue." The statement added, "Our security teams have no evidence of any unauthorized access," without providing any further details about the claim. The spokesperson would not say, when asked, whether the company had the technical means, such as server logs, to determine if anyone had access to the customer database prior to Wiggins' discovery.

03Notice, the SEC, and hardcoding

TechCrunch asked whether Wyndham planned to notify customers whose information was exposed, or to disclose the incident to U.S. regulators, such as filing a notice with the U.S. Securities and Exchange Commission.

Public companies are required to make that kind of filing for material cybersecurity incidents. Wyndham would not say, and its spokesperson also would not say for how long the password was embedded in its customer app, or how Wyndham plans to ship a long-term fix for the app.

App and software developers generally avoid including passwords or credentials in publicly released software and apps, a process known as hardcoding, because anyone with a copy of the software can extract the password and use it to access the associated server or database. Given the simplicity with which credentials can be abused by anyone, many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating.

04Applebee's app and past access

For Wiggins, this is his second public discovery of hardcoded credentials in two weeks, after he found a near-identical vulnerability in Applebee's app that exposed customer data. He relied on AI tools for both discoveries. Those tools make it easier to identify simple security weaknesses, such as hardcoded credentials, by scouring thousands of lines of decompiled app code every second.

When asked about Wyndham's response, Wiggins told TechCrunch that he was glad the company fixed the issue, but noted that without visibility into any past activity, someone with malicious intent could have leaked large amounts of customers' personal information. The company would not say whether it planned to set up a vulnerability disclosure program to allow outside security researchers and hackers to privately report security vulnerabilities.

05Disclosure email and pcTattletale

Michael Francess, Wyndham's cybersecurity director who responded to the incident, told TechCrunch that researchers can alert the company by email with details of potential security issues. The company's spokesperson would not say whether it plans to change its website to allow researchers to alert the company.

This is the latest known security incident at Wyndham in recent years. In 2024, a security researcher found several Wyndham hotel check-in desks running remote-access spyware that was leaking screenshots of guest records and booking information to the open web.

Soon after TechCrunch's reporting, the spyware app found on the hotel computers, called pcTattletale, was hacked and its banks of customer data stolen, forcing pcTattletale's owner, Bryan Fleming, to shut that company down. Fleming, a former resident of Michigan, was later arrested by federal authorities and convicted of making, selling, and advertising unlawful spyware.