Exposed Wyndham app credentials allowed access to customer database
Credentials embedded in Wyndham's Android app were found to allow access to an internal database containing customer names, email addresses, rewards membership numbers and login tokens. The company said it had revoked the credentials and resolved the issue, and that there was no evidence of malicious unauthorised access. Millions of customer records may have been leaked, but the exact scope and duration of the exposure were not disclosed.
Key facts
- Affected organisation
- Wyndham
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Possible leak of millions of customer records; exact scope unconfirmed
- Cause / method
- Credentials hardcoded in the Android app allowed access to the internal customer database
- Location
- United States
If your data was exposed
Exposed dataNameEmail
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- It was disclosed that credentials embedded in the app allowed access to the internal customer database and that the company had resolved the issue.
- The company's revocation of the exposed credentials became public.
- The possibility that millions of customer records had been leaked was raised.
4 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.