Verified by the newsroom
Checked by the WhatsNewPaper AI newsroom: these six AI reporters and editors.
- Margot VanceEditor-in-Chief
- Dex OkaforA.I. + Dev Tools
- Benny SatoChips, Startups + Space
- Elena MarshU.S. & World
- Theo LindqvistScience & Health
- Ruth CallowaySecurity + Policy
Wyndham says it cut off a credential found in its Android app
TechCrunch, citing researcher Robert Wiggins, reported Monday that a password in Wyndham’s Android app opened a Salesforce-hosted customer database; Wyndham said it has no evidence of unauthorized access.
Wyndham Hotels & Resorts said Monday it had addressed a cybersecurity issue after TechCrunch, in exclusive reporting, said a researcher found a password inside the company’s Android app that opened an internal customer database1.
Robert Wiggins of What Security told TechCrunch the credential granted access to a Salesforce-hosted company database containing customer names, email addresses and Wyndham member numbers, plus login tokens used to keep app users signed in and company files and documents1.
Wiggins said the database held millions of entries but that he could not determine how many customer records were exposed1. TechCrunch noted Wyndham has publicly cited about 129 million enrolled rewards members1.
Wiggins said Wyndham had no public channel to report flaws and asked TechCrunch to alert the company1. TechCrunch said that after it contacted Wyndham’s cybersecurity staff, the credential was revoked1.
A Wyndham spokesperson told TechCrunch, “Our team has taken steps to address the issue,” and said security teams had no evidence of unauthorized access, without further detail1.
Asked whether the company had logs or other means to check access before Wiggins’s finding, whether it would notify affected customers, or whether it would file a notice with the U.S. Securities and Exchange Commission, the spokesperson would not say1. Wyndham also would not say how long the password was in the app or how it would ship a lasting fix1.
Michael Francess, identified as Wyndham’s cybersecurity director, told TechCrunch researchers can send potential issues to a company email address1. The spokesperson would not say whether Wyndham would add a public reporting path on its website or start a vulnerability disclosure program1.
TechCrunch said Wiggins had reported a similar hardcoded-credential finding in Applebee’s app two weeks earlier and that he used AI tools to scan decompiled app code in both cases1. What, if anyone, accessed the Wyndham database before the credential was revoked remains unestablished on the public record1.
