Hotel giant Wyndham exposed customer data after app security lapse

Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers’ personal information.

Security researcher Robert Wiggins at What Security exclusively told TechCrunch that he found a password inside the source code of Wyndham’s Android app, which granted access to an internal company database, hosted by tech company Salesforce.

Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses, and Wyndham member numbers. The database also stores customer login tokens (called JWTs) that keep customers logged-in to their apps without having to repeatedly enter their own passwords. The database also contained Wyndham files and documents.

According to Wiggins, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records. Wyndham touts some 129 million enrolled rewards members.

The researcher said Wyndham has no way to report security flaws, and asked for TechCrunch’s help in alerting the company. Soon after TechCrunch made contact with Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing any further access to the database. 

“Our team has taken steps to address the issue,” a Wyndham spokesperson told TechCrunch. “Our security teams have no evidence of any unauthorized access,” the statement added, without providing any further details about the claim. 

Wyndham’s spokesperson would not say, when asked, whether the company had the technical means, such as server logs, to determine if anyone had access to the customer database prior to Wiggins’ discovery.

TechCrunch also asked Wyndham whether it planned to notify customers whose information was exposed, or disclose the incident to U.S. regulators, such as filing a notice with the U.S. Securities and Exchange Commission, as public companies are required to do for material cybersecurity incidents. Wyndham would not say.

Wyndham’s spokesperson also would not say for how long the password was embedded in its customer app, or how Wyndham plans to ship a long-term fix for the app.

App and software developers generally avoid including passwords or credentials in publicly released software and apps — a process known as “hardcoding” — as anyone with a copy of the software can extract the password and use it to access its associated server or database. Given the simplicity with which credentials can be abused by anyone, many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating.

For Wiggins, this is his second public discovery of hardcoded credentials in two weeks, after finding a near-identical vulnerability in Applebee’s app that exposed customer data. Wiggins relied on AI tools for both discoveries, which make it easier to identify simple security weaknesses, such as hardcoded credentials, by scouring thousands of lines of decompiled app code every second.

When asked about Wyndham’s response, Wiggins told TechCrunch that he was glad the company fixed the issue, but noted that without visibility into any past activity, someone with malicious intent could have leaked large amounts of customers’ personal information.

The company would not say whether it planned to set up a vulnerability disclosure program to allow outside security researchers and hackers to privately report security vulnerabilities. 

Michael Francess, Wyndham’s cybersecurity director who responded to the incident, told TechCrunch that researchers can alert [email protected] with details of potential security issues. The company’s spokesperson would not say whether it plans to change its website to allow researchers to alert the company. 

This is the latest known security incident at Wyndham in recent years. In 2024, a security researcher found several Wyndham hotel check-in desks were running remote-access spyware that was leaking screenshots of guest records and booking information to the open web. 

Soon after our reporting, the spyware app found on the hotel computers, called pcTattletale, was hacked and its banks of customer data stolen, forcing the company’s owner, Bryan Fleming, to shut down the company. Fleming, a former resident of Michigan, was later arrested by federal authorities and convicted of making, selling, and advertising unlawful spyware.