Hotel giant Wyndham exposed customer data after app security lapse

Hotel and edifice elephantine Wyndham has acknowledged a cybersecurity incidental aft a good-faith information researcher discovered a bug that allowed anyone to entree customers’ idiosyncratic information.

Security researcher Robert Wiggins astatine What Security exclusively told TechCrunch that helium recovered a password wrong the root codification of Wyndham’s Android app, which granted entree to an interior institution database, hosted by tech institution Salesforce.

Wiggins told TechCrunch that the credential exposed idiosyncratic accusation including lawsuit names, email addresses, and Wyndham subordinate number. The database besides stores lawsuit login tokens (called JWTs) that support customers logged-in to their apps without having to repeatedly participate their ain passwords. The database besides contained Wyndham files and documents.

According to Wiggins, the database had millions of entries, but helium was incapable to find an close fig of exposed lawsuit records. Wyndham touts immoderate 129 cardinal enrolled rewards members.

The researcher said Wyndham has nary mode to study information flaws, and asked for TechCrunch’s assistance successful alerting the company. Soon aft TechCrunch made interaction with Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing immoderate further entree to the database. 

“Our squad has taken steps to code the issue,” a Wyndham spokesperson told TechCrunch. “Our information teams person nary grounds of immoderate unauthorized access,” the connection added, without providing immoderate further details astir the claim. 

Wyndham’s spokesperson would not say, erstwhile asked, whether the institution had the method means, specified arsenic server logs, to find if anyone had entree to the lawsuit database anterior to Wiggins’ discovery.

TechCrunch besides asked Wyndham whether it planned to notify customers whose accusation was exposed, oregon disclose the incidental to U.S. regulators, specified arsenic filing announcement with the U.S. Securities and Exchange Commission, arsenic nationalist companies are required to bash for worldly cybersecurity incidents. Wyndham would not say.

Wyndham’s spokesperson besides would not accidental for however agelong the password was embedded successful its lawsuit app, oregon however Wyndham plans to vessel a semipermanent hole for the app.

App and bundle developers mostly debar including passwords oregon credentials successful publically released bundle and apps — a process known arsenic “hardcoding” — arsenic anyone with a transcript of the bundle tin extract the password and usage it to entree its associated server oregon database. Given the simplicity with which credentials tin beryllium abused by anyone, galore cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating.

For Wiggins, this is his 2nd nationalist find of hardcoded credentials successful 2 weeks, aft uncovering a near-identical vulnerability successful Applebee’s app that exposed lawsuit data. Wiggins relied connected AI tools for some discoveries, which marque it easier to place elemental information weaknesses, specified arsenic hardcoded credentials, by scouring thousands of lines of decompiled app codification each second.

When asked astir Wyndham’s response, Wiggins told TechCrunch that helium was gladsome the institution fixed the issue, but noted that without visibility into immoderate past activity, idiosyncratic with malicious intent could person leaked ample amounts of customers’ idiosyncratic information.

The institution would not accidental whether it planned to acceptable up a vulnerability disclosure programme to let extracurricular information researchers and hackers to privately study information vulnerabilities. 

Michael Francess, Wyndham’s cybersecurity manager who responded to the incident, told TechCrunch that researchers tin alert [email protected] with details of imaginable information issues. The company’s spokesperson would not accidental say whether it plans to alteration its website to let researchers to alert the company. 

This is the latest known information incidental astatine Wyndham successful caller years. In 2024, a information researcher recovered several Wyndham edifice check-in desks were moving remote-access spyware that was leaking screenshots of impermanent records and booking accusation to the unfastened web. 

Soon aft our reporting, the spyware app recovered connected the edifice computers, called pcTattletale, was hacked and its banks of lawsuit information stolen, forcing the company’s owner, Bryan Fleming, to unopen down the company. Fleming, a erstwhile nonmigratory of Michigan, was aboriginal arrested by national authorities and convicted of making, selling, and advertizing unlawful spyware.