Wyndham Exposes Customer Data Due to Hardcoded Credentials in App

• •Wyndham's Android app exposed customer data due to hardcoded credentials.
• •The database potentially contains millions of records, but exact numbers are unknown.
• •Wyndham has not confirmed if unauthorized access occurred before the flaw was fixed.

Wyndham Hotels & Resorts confirmed a cybersecurity incident where hardcoded credentials in its Android app exposed customer data, including names, emails, and login tokens. Security researcher Robert Wiggins discovered the flaw, which allowed access to an internal database containing millions of records. Although Wyndham has stated that the issue has been resolved and there is no evidence of unauthorized access, the exact number of affected individuals and the duration of the exposure remain unclear. The database was reportedly hosted by Salesforce, and the hardcoded credentials were not removed prior to the app's release. Wiggins had difficulty contacting Wyndham directly to report the issue, leading him to reach out to TechCrunch for assistance. Wyndham claims to have taken steps to address the issue but has not disclosed whether it will notify affected customers or report the incident to regulators.