Anyone who downloaded Wyndham’s Android app could have pulled a password out of its code and used it to open an internal customer database. Wyndham has acknowledged the incident and revoked the credential, but the story reaches well beyond one hotel group: the same mistake can sit inside any app, from a bank to a food-delivery service.
The researcher behind the find, Robert Wiggins of What Security, says the database sat on Salesforce and held millions of records: names, email addresses, loyalty numbers, the login tokens that keep people signed in to the app, and a pile of company documents. He could not pin down how many customers were affected. For scale, Wyndham says its rewards programme has about 129 million members.
Wyndham’s statement is short: its security teams have “no evidence of any unauthorized access”. What it declined to say matters more. The company would not confirm whether it keeps the server logs needed to check for earlier use of the password, how long the password had been in the app, whether it will notify customers, or whether it will file a disclosure with US regulators.
TechCrunch’s exclusive report on 9 November says Wiggins went to a journalist because Wyndham offers outsiders no channel for reporting flaws. The credential was cancelled soon after the company’s security staff were contacted. Wiggins had reported almost the same mistake in the Applebee’s app barely two weeks earlier, and he used AI tools to scan decompiled app code, which makes this kind of slip quick to find for researchers and for attackers alike.
An Android app is a file that anyone can download, unpack and read. A password, API key or access token written into that file is therefore public the moment the app is published. The OWASP Mobile Top 10 lists hardcoded credentials as the first of its mobile risks and notes that attackers can find them with automated tools, so this is a well-known failure, not an exotic one.
For the teams that build apps, the fixes are mostly habits. Keep secrets on a server and let the app hold nothing more powerful than a short-lived token issued after the user signs in. Give every credential the narrowest access it needs, so a leaked one cannot open a whole customer database. Scan each build for keys and passwords before release, rotate anything that has ever shipped in an app, and keep access logs long enough to answer the question Wyndham would not: was it used? A published security contact, so a researcher can report a flaw without going to the press, costs almost nothing.
The problem is not limited to the US. Apps built this way turn up in every region, Pakistan included, and we have not examined any particular company’s app. Any organisation that ships a mobile app and stores names, phone numbers or account details, whether a bank, a retailer or a hotel group, should assume the app file can be read by anyone and check what is inside it.
For customers, the exposure of names, emails and member numbers means the likeliest harm is a convincing scam. Expect messages that quote a real booking or loyalty number, treat any link in them with suspicion and go to the company’s app or site directly. Use a different password for every service, switch on two-step verification where it is offered, and sign out of an app on any phone you no longer use.
