Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers’ personal information.
Security researcher Robert Wiggins at What Security exclusively told TechCrunch that he found a password inside the source code of Wyndham’s Android app, which granted access to an internal company database, hosted by tech company Salesforce.
Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses, and Wyndham member number. The database also stores customer login tokens (called JWTs) that keep customers logged-in to their apps without having to repeatedly enter their own passwords. The database also contained Wyndham files and documents.
According to Wiggins, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records. Wyndham touts some 129 million enrolled rewards members.
The researcher said Wyndham has no way to report security flaws, and asked for TechCrunch’s help in alerting the company. Soon after TechCrunch made contact with Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing any further access to the database.
“Our team has taken steps to address the issue,” a Wyndham spokesperson told TechCrunch. “Our security teams have no evidence of any unauthorized access,” the statement added, without providing any further details about the claim.
Wyndham’s spokesperson would not say, when asked, whether the company had the technical means, such as server logs, to determine if anyone had access to the customer database prior to Wiggins’ discovery.
TechCrunch also asked Wyndham whether it planned to notify customers whose information was exposed, or disclose the incident to U.S. regulators, such as filing notice with the U.S. Securities and Exchange Commission, as public companies are required to do for material cybersecurity incidents. Wyndham would not say.
Wyndham’s spokesperson also would not say for how long the password was embedded in its customer app, or how Wyndham plans to ship a long-term fix for the app.
App and software developers generally avoid including passwords or credentials in publicly released software and apps — a process known as “hardcoding” — as anyone with a copy of the software can extract the password and use it to access its associated server or database. Given the simplicity with which credentials can be abused by anyone, many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating.
For Wiggins, this is his second public discovery of hardcoded credentials in two weeks, after finding a near-identical vulnerability in Applebee’s app that exposed customer data. Wiggins relied on AI tools for both discoveries, which make it easier to identify simple security weaknesses, such as hardcoded credentials, by scouring thousands of lines of decompiled app code every second.
When asked about Wyndham’s response, Wiggins told TechCrunch that he was glad the company fixed the issue, but noted that without visibility into any past activity, someone with malicious intent could have leaked large amounts of customers’ personal information.
The company would not say whether it planned to set up a vulnerability disclosure program to allow outside security researchers and hackers to privately report security vulnerabilities.
Michael Francess, Wyndham’s cybersecurity director who responded to the incident, told TechCrunch that researchers can alert [email protected] with details of potential security issues. The company’s spokesperson would not say say whether it plans to change its website to allow researchers to alert the company.
This is the latest known security incident at Wyndham in recent years. In 2024, a security researcher found several Wyndham hotel check-in desks were running remote-access spyware that was leaking screenshots of guest records and booking information to the open web.
Soon after our reporting, the spyware app found on the hotel computers, called pcTattletale, was hacked and its banks of customer data stolen, forcing the company’s owner, Bryan Fleming, to shut down the company. Fleming, a former resident of Michigan, was later arrested by federal authorities and convicted of making, selling, and advertising unlawful spyware.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at [email protected].
Get an Early Peek at the Next TechCrunch DisruptDisrupt, Startup Battlefield, and more will return next year, and you can be at the front of the line.Sign up for our events newsletter
Tesla will stop making the Cybertruck in 2027
Sean O'Kane
Claude can now analyze your spending with its new Personal Finance tool
Aisha Malik
Harbinger raises $240M after expanding into defense
Sean O'Kane
Almost no one uses AI agents to book their Uber, company says
Sarah Perez
Meta acquires AI coding startup Conductor
Lucas Ropek
Data centers are turning to old jet engines as the wait for power grows
Aditya Mehta
New York City’s Mamdani criticizes Madison Square Garden owner over surveillance tech
Zack Whittaker
Fox Style News Syndicate. Sourced from broadcast reporting: Read Full Source Coverage.