Hotel giant Wyndham exposed customer data after app security lapse

A security flaw in Wyndham’s Android app exposed customer information stored in an internal database hosted by Salesforce. Researcher Robert Wiggins found a password embedded in the app’s code, where anyone could extract it and use it to access the database. The records included customers’ names, email addresses, Wyndham Rewards member numbers, and login tokens that keep users signed in, as well as company files and documents. The database contained millions of entries, though Wiggins could not establish how many customer records were exposed; Wyndham says it has about 129 million rewards members.

Wyndham revoked the credential after the researcher and TechCrunch contacted its security team. The company said it had addressed the issue and had no evidence of unauthorized access, but did not clarify whether it could check logs, how long the password had been exposed, or whether it would notify customers or regulators. Wiggins welcomed the fix but warned that the company’s limited visibility into prior access left open the possibility of data theft. The incident also highlights how AI tools can help researchers quickly find hardcoded credentials in app code. It follows another such discovery by Wiggins in an Applebee’s app and adds to Wyndham’s history of security problems, including hotel check-in computers found leaking guest information in 2024.