Hotel and resort company Wyndham has acknowledged a cybersecurity incident after a security researcher discovered a vulnerability in its Android app. Robert Wiggins at What Security found a password embedded in the app's source code, which granted access to an internal company database hosted by Salesforce.
This database reportedly contained personal information such as customer names, email addresses, Wyndham member numbers, and customer login tokens. It also stored Wyndham files and documents. Wiggins stated the database had millions of entries but could not provide an exact number of exposed customer records.
After TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked, preventing further access. A Wyndham spokesperson stated that their team had addressed the issue and had "no evidence of any unauthorized access." However, the spokesperson would not confirm if the company had the technical means, such as server logs, to determine if the database had been accessed prior to Wiggins' discovery.
Wyndham also declined to comment on whether it plans to notify affected customers or disclose the incident to U.S. regulators. The company would not say how long the password was in the app or how it plans to implement a long-term fix. Wiggins, who used AI tools for this discovery, noted that without visibility into past activity, malicious actors could have leaked significant amounts of customer data.