Wyndham's Android App Exposes Millions of Customer Records

A major hotel and resort chain has suffered a significant cybersecurity breach after a researcher discovered a vulnerable app that exposed customers' personal information.

Security expert Robert Wiggins stumbled upon a password in the source code of Wyndham's Android app, which granted access to an internal database hosted by Salesforce. This database contained sensitive customer data, including names, email addresses, and membership numbers. The database also stored login tokens (JWTs) that allowed customers to remain logged in without re-entering their passwords.

The exposed database had millions of entries, although the exact number of affected records is unknown. Wyndham boasts a massive 129 million enrolled rewards members. Wiggins noted that the database also held various Wyndham files and documents.

Wiggins reached out to TechCrunch for help alerting Wyndham about the security flaw since he couldn't find an official reporting channel within the company's app. Following TechCrunch's contact with Wyndham's cybersecurity team, the exposed credential was promptly revoked, preventing further unauthorized access.

Wyndham has acknowledged the incident and stated that its security teams have taken steps to address the issue. However, they claimed to have found no evidence of any unauthorized access to the database, without providing additional details about their investigation.

Despite repeated questions from TechCrunch, Wyndham's spokesperson was tight-lipped about whether the company had access to technical tools that could determine if any unauthorized individuals accessed the customer database before Wiggins' discovery.

When asked about notifying customers whose information was exposed or disclosing the incident to U.S. regulators, such as filing a notice with the Securities and Exchange Commission, Wyndham's spokesperson remained silent.

The company also declined to provide details on how long the password was embedded in its customer app or what steps it plans to take to fix the issue permanently.

Including passwords or credentials in publicly released software and apps is widely regarded as a security risk, known as "hardcoding," which can be exploited by anyone with access to the code. This vulnerability is often assigned the highest severity rating due to its simplicity and potential for abuse.

Wiggins' discovery of hardcoded credentials marks his second high-profile finding in two weeks, following a similar vulnerability in Applebee's app that put customer data at risk. He used AI tools to identify the weakness, which can scan thousands of lines of code per second to detect simple security flaws like this one.

Wyndham's handling of the recent security lapse has raised questions about its ability to prevent similar incidents in the future. The company was criticized for not providing clear guidance on how outside researchers can report potential vulnerabilities.

In an interview, Wyndham's cybersecurity director Michael Francess revealed that researchers can alert the company at [email protected] with details of potential security issues. However, it remains unclear whether this is a formal vulnerability disclosure program or simply an email address for reporting concerns.

The lack of transparency in Wyndham's response to the incident has sparked concerns about data protection. Without visibility into past activity, someone with malicious intent could have leaked large amounts of customers' personal information, as security researcher Wiggins pointed out.

Wyndham has faced several security incidents in recent years. In 2024, a security researcher discovered that Wyndham hotel check-in desks were running remote-access spyware called pcTattletale. This malware was leaking screenshots of guest records and booking information to the open web.

The situation took a more serious turn when the pcTattletale app was hacked, allowing attackers to steal customer data. The company's owner Bryan Fleming was later arrested by federal authorities and convicted of making, selling, and advertising unlawful spyware.

The security lapse at Wyndham's app exposed customer data due to a vulnerability in its API key system. The issue was discovered by researchers from a prominent cybersecurity firm who identified that an attacker could obtain sensitive information about users and hotels by manipulating the API keys.

This flaw allowed unauthorized access to user data, including names, email addresses, phone numbers, and even financial information such as credit card details. The affected systems were reportedly used for various internal processes like customer support and hotel management.

In a worrying trend, this incident highlights the need for companies to prioritize app security and regularly test their systems for vulnerabilities. As sensitive customer data continues to be compromised in similar incidents, it becomes increasingly clear that robust security measures are essential in today's digital landscape.

The exposure of Wyndham's customers' personal information serves as a stark reminder of the importance of robust cybersecurity practices, underscoring the need for companies to protect their users' data and prevent such breaches from occurring.