Hotel giant Wyndham exposed customer data after app security lapse

Your personal data may have been exposed without your knowledge, and Wyndham has not confirmed if it will notify affected customers.

Hotel giant Wyndham has acknowledged a cybersecurity incident following the discovery of a security flaw in its Android application. Security researcher Robert Wiggins found a password embedded within the app's source code, which granted access to an internal database hosted by Salesforce. This database contained sensitive customer information, including names, email addresses, and Wyndham member numbers, as well as login tokens that keep users authenticated. The database also held Wyndham company files. While Wiggins could not ascertain the exact number of exposed records, Wyndham has approximately 129 million rewards members. Upon notification by TechCrunch, Wyndham revoked the credential, preventing further access. A Wyndham spokesperson stated that their teams have addressed the issue and found no evidence of unauthorized access, but declined to comment on whether they could determine prior access or if customers would be notified, or if regulators would be informed.

The discovery highlights a persistent security risk in mobile application development, specifically the practice of hardcoding credentials. This method, easily detectable and exploitable, is a common vulnerability that attackers can leverage to gain access to sensitive backend systems. The ease with which AI tools can now identify such flaws suggests that companies failing to adhere to basic security hygiene will face increasing exposure. Wyndham's response, including a lack of transparency regarding past access and future notification plans, underscores a broader industry challenge in managing and disclosing data security incidents effectively.

This incident also brings renewed attention to the need for robust vulnerability disclosure programs within large corporations. While Wyndham has provided an email address for reporting issues, its reluctance to establish a formal program could deter researchers and delay the identification of critical flaws. The lack of clear communication on regulatory compliance and customer notification raises questions about Wyndham's commitment to data privacy and its adherence to evolving cybersecurity standards. The company's history of security issues, including a 2024 spyware incident, suggests a pattern of recurring vulnerabilities that require more comprehensive remediation strategies.