Wyndham Acknowledges Cybersecurity Incident After Hardcoded Password Exposes Millions of Customer Records

Hotel and resort giant Wyndham has confirmed a significant cybersecurity incident following the discovery of a critical vulnerability by a good-faith security researcher. The flaw, which involved a hardcoded password embedded within the company’s Android application, granted unauthorized access to an internal company database containing customers’ personal information. The incident underscores pervasive security challenges in software development and highlights the critical need for robust vulnerability disclosure mechanisms within large corporations.

The discovery was made by Robert Wiggins, a security researcher affiliated with What Security, who exclusively detailed his findings to TechCrunch. Wiggins revealed that he uncovered a password meticulously hidden within the source code of Wyndham’s official Android app. This single credential served as a gateway, providing unfettered access to an internal company database. This critical repository, hosted by the prominent tech company Salesforce, contained a wealth of sensitive customer data and internal corporate documents.

The exposed information was extensive and highly sensitive. Wiggins confirmed that the credential granted access to personal identifiable information (PII) including customer names, email addresses, and unique Wyndham member numbers. Beyond basic PII, the database also stored customer login tokens, commonly referred to as JSON Web Tokens (JWTs). These tokens are crucial for maintaining user sessions, allowing customers to remain logged into their apps without the repetitive need to re-enter their passwords. The compromise of these JWTs could potentially enable session hijacking, granting malicious actors unauthorized access to user accounts. Furthermore, the database also housed various Wyndham files and documents, the nature of which was not fully specified but could encompass proprietary information or operational data.

According to Wiggins’ assessment, the Salesforce-hosted database contained "millions of entries." While he was unable to ascertain an exact figure for the total number of exposed customer records, the sheer volume suggests a significant breach potential. Wyndham itself boasts an immense customer base, touting approximately 129 million enrolled rewards members globally. This vast membership pool indicates the potential scale of individuals whose data could have been at risk.

A critical aspect of this incident was the absence of a readily apparent and formal channel for security researchers to report vulnerabilities directly to Wyndham. Wiggins indicated that Wyndham lacked a clear mechanism for disclosing security flaws responsibly. Consequently, he sought assistance from TechCrunch to facilitate communication with the company and alert them to the severe vulnerability. Prompt action followed this intervention: shortly after TechCrunch established contact with Wyndham’s cybersecurity staff, the exposed credential was swiftly revoked, effectively preventing any further unauthorized access to the compromised database.

In response to the incident, a Wyndham spokesperson provided a brief statement to TechCrunch: "Our team has taken steps to address the issue." The spokesperson further asserted, "Our security teams have no evidence of any unauthorized access," a claim that was notably delivered without any supporting details or elaboration. When pressed for more information, particularly whether the company possessed the technical capabilities, such as comprehensive server logs, to definitively determine if any unauthorized parties had accessed the customer database prior to Wiggins’ discovery, Wyndham’s spokesperson declined to comment. This lack of transparency raised concerns among security experts regarding the company’s ability to fully assess the extent of the breach.

Furthermore, TechCrunch inquired whether Wyndham intended to notify the customers whose information had been exposed as a result of the incident. They also asked if the company planned to disclose the incident to relevant U.S. regulators, specifically filing a notice with the U.S. Securities and Exchange Commission (SEC), a requirement for public companies concerning material cybersecurity incidents. Again, Wyndham’s spokesperson would not provide a definitive answer, leaving critical questions about potential consumer notification and regulatory compliance unanswered. The company also remained silent on how long the critical password had been embedded within its customer app and what specific long-term technical solutions Wyndham intended to implement to prevent similar occurrences in the future.

The root cause of this vulnerability lies in a well-known, yet persistent, anti-pattern in software development known as "hardcoding." App and software developers are strongly advised against including sensitive information like passwords or credentials directly within publicly released software and applications. When credentials are hardcoded, anyone with a copy of the software can easily extract them, often through reverse engineering or simply inspecting the application’s source code (as was the case here). Once extracted, these credentials can be abused to gain unauthorized access to associated servers or databases. Given the simplicity with which hardcoded credentials can be exploited, such vulnerabilities are frequently assigned a maximum severity rating by cybersecurity frameworks, reflecting their high potential for catastrophic impact.

For Robert Wiggins, this discovery marks his second public exposure of hardcoded credentials within a mere two weeks. His previous finding involved a "near-identical vulnerability" within the Applebee’s app, which also led to the exposure of customer data. Wiggins’ success in identifying these "simple security weaknesses" in complex application code is partly attributed to his innovative use of Artificial Intelligence (AI) tools. These AI-powered solutions can efficiently scour thousands of lines of decompiled app code per second, drastically accelerating the identification of common yet critical flaws like hardcoded credentials.

Reflecting on Wyndham’s response, Wiggins expressed satisfaction that the company addressed the immediate issue by revoking the credential. However, he voiced a significant concern: without comprehensive visibility into past activity on the compromised database, it remains impossible to definitively rule out prior malicious access. Wiggins warned that had a malicious actor discovered and exploited this vulnerability before his intervention, they could have potentially exfiltrated vast quantities of customers’ personal information, leading to far more severe consequences.

Another point of contention was Wyndham’s stance on establishing a formal vulnerability disclosure program (VDP). When asked, the company would not confirm whether it planned to set up such a program, which would provide a structured and secure channel for independent security researchers and ethical hackers to privately report security vulnerabilities. While Wyndham’s cybersecurity director, Michael Francess, who responded to the incident, did provide an email address ([email protected]) for researchers to submit potential security issues, the company’s spokesperson would not confirm if they planned to update their official website to prominently feature this contact information or to formalize a comprehensive VDP.

This latest incident is not an isolated event in Wyndham’s recent security history. In 2024, another security researcher uncovered a disturbing vulnerability involving several Wyndham hotel check-in desks. These systems were found to be running remote-access spyware, specifically an application called pcTattletale. This malicious software was actively leaking screenshots of guest records and booking information directly to the open web, exposing highly sensitive travel and personal data.

The repercussions of the pcTattletale discovery were swift and far-reaching. Soon after TechCrunch’s reporting on the spyware, pcTattletale itself became the target of a cyberattack. Its systems were hacked, its customer data banks were stolen, and its website was defaced. This devastating blow ultimately forced Bryan Fleming, the company’s owner, to shut down the operation. Fleming, a former resident of Michigan, was subsequently arrested by federal authorities and convicted for his role in making, selling, and advertising unlawful spyware.

The repeated security challenges faced by Wyndham, from hardcoded credentials in its mobile app to third-party spyware on its hotel systems, underscore the complex and evolving landscape of cybersecurity threats that hospitality giants must navigate. These incidents highlight the critical importance of proactive security measures, transparent communication with researchers and customers, and robust incident response protocols to protect sensitive customer data in an increasingly interconnected digital world.