Wyndham exposes customer data after app security lapse
Hotel chain Wyndham acknowledged a cybersecurity incident after a researcher found a password in its Android app that exposed millions of customer records.
Researcher finds hidden password
Security researcher Robert Wiggins discovered a bug allowing access to personal information. He found a password inside the source code of Wyndham's Android app. This credential granted entry to an internal company database hosted by Salesforce. The exposed data included customer names, email addresses, and Wyndham member numbers.
Database contained login tokens
The compromised database also stored customer login tokens known as JWTs. These tokens keep users logged in without requiring repeated password entry. Wyndham touts approximately 129 million enrolled rewards members within its system. Wiggins could not determine the exact number of exposed records from the database.
Company revokes access quickly
TechCrunch contacted Wyndham's cybersecurity staff after Wiggins requested their help to alert the firm. Soon after contact, the exposed credential was revoked preventing further database access. A spokesperson stated the team took steps to address the issue immediately. The company has no evidence of unauthorized access prior to this discovery.
Reported by one outlet
Only one outlet has published this. Nothing here has been checked against a second report, so read it as that outlet's account and follow the link below for the original.
Reported by
1 independent outlet. Headline as published. Links open the original report.