Hotel giant Wyndham exposed customer data after app security lapse

Wyndham says it addressed a security flaw in its Android app after researcher Robert Wiggins found a password embedded in the app’s code. The credential provided access to an internal database containing customer information, login tokens and company documents, raising questions about how long the data was exposed and whether anyone accessed it.

Wiggins said the database held millions of entries, though he could not establish how many customer records were exposed; Wyndham has about 129 million rewards members. The company revoked the credential after being contacted, but said it had no evidence of unauthorised access and did not explain whether it could check past activity. It also did not say whether it would notify affected customers, report the incident to US regulators or establish a formal channel for security researchers.