Wyndham exposes customer data through hardcoded password in Android app
Wyndham has not said whether affected customers will be told or whether regulators will be notified, leaving open how many people were exposed.
Hotel group Wyndham has confirmed a security incident after an independent researcher, Robert Wiggins, found a hardcoded password in its Android app that opened an internal Salesforce-hosted database. The exposed data reportedly included customer names, email addresses, member numbers, login tokens and internal files, with millions of entries, though the exact count of affected customers could not be determined. The credential was revoked only after the researcher's concerns reached Wyndham through TechCrunch, and the company says it has seen no evidence of unauthorised access but has not explained how it reached that conclusion. Wyndham declined to say whether customers will be notified, whether it will report the matter to US regulators, how long the password was in the app, or whether it will open a vulnerability disclosure channel. The episode follows a similar hardcoded-credential finding in Applebee's app two weeks earlier, a sign of how easily AI tools can now surface such flaws in shipped mobile code.
Why it matters
The exposure reaches a loyalty base of 129 million enrolled rewards members, so the question of who was affected is large. Customers whose names, email addresses, member numbers and login tokens sat in the exposed database cannot yet tell from Wyndham's statements whether their accounts were touched, and the company's view that no unauthorised access occurred rests on a conclusion it has not explained. For people who follow the industry, the episode shows a credential sitting in a shipped app long enough to reach an outside researcher before it was revoked.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.