THE CRUNCH
Wyndham has acknowledged a cybersecurity incident after a researcher found a password embedded in its Android app that let anyone access an internal customer database. Robert Wiggins of What Security told TechCrunch he discovered the credential in the app's source code, and it granted access to a Salesforce-hosted database containing customer names, email addresses, Wyndham member numbers, login tokens and company files. He said the database held millions of entries, though an exact count of exposed records could not be determined. Wyndham says it has around 129 million enrolled rewards members.
Soon after TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked, cutting off access. "Our team has taken steps to address the issue," a Wyndham spokesperson said, adding that security teams have "no evidence of any unauthorized access." The spokesperson would not say whether the company has server logs to check for prior access, whether customers will be notified, or whether it will disclose the incident to US regulators as material incidents may require.
Embedding passwords in released software, known as hardcoding, is widely avoided because anyone with a copy of the app can extract the credential and use it. Such flaws are often automatically rated at maximum severity. Wiggins said Wyndham had no way for outsiders to report security flaws, which is why he asked TechCrunch to make contact; the company's cybersecurity director later pointed researchers to an email address for reporting issues.
This was Wiggins's second hardcoded-credential discovery in two weeks, after a similar flaw in the Applebee's app, and he used AI tools in both cases. Such tools can scour thousands of lines of decompiled app code per second, making simple weaknesses like embedded passwords easier to find. Wiggins said that without visibility into past activity, someone malicious could have leaked large amounts of customer data.