Hotel giant Wyndham has confirmed a significant cybersecurity incident following the discovery of a vulnerability in its Android application that inadvertently exposed sensitive customer information. A security researcher identified a hardcoded password within the app’s source code, which granted unauthorized access to an internal company database hosted by Salesforce.

The exposed database contained a wealth of personal data, including customer names, email addresses, and Wyndham member identification numbers. Crucially, it also held login tokens (JWTs) that allow users to remain logged into the app without re-entering credentials, as well as internal Wyndham documents. While the exact number of affected customer records remains unconfirmed, the database is believed to contain millions of entries, potentially impacting a substantial portion of Wyndham’s 129 million rewards members.

According to the researcher, Robert Wiggins, Wyndham lacked a clear channel for reporting security vulnerabilities, prompting him to involve a tech publication to alert the company. Upon notification, Wyndham’s cybersecurity team promptly revoked the compromised credential, thereby preventing further unauthorized access. A spokesperson for Wyndham stated that the issue has been addressed and that the company has found no evidence of unauthorized access to the database. However, the company declined to provide details on whether it possesses the technical means, such as server logs, to ascertain if any data was accessed prior to the discovery, or if customers will be notified of the breach.

This incident highlights a common security pitfall known as “hardcoding,” where sensitive credentials are embedded directly into application code. This practice is generally discouraged as it makes it relatively simple for anyone with access to the software to extract the credentials and gain entry to associated systems. The researcher noted that AI tools are increasingly aiding in the detection of such vulnerabilities. Wyndham has not yet disclosed plans for a long-term fix for the app or whether it will implement a formal vulnerability disclosure program for external researchers.

Key Takeaways

• A security flaw in Wyndham's Android app exposed customer names, emails, and login tokens due to a hardcoded password.
• The vulnerability granted access to an internal database containing millions of customer records and company documents.
• Wyndham has revoked the compromised credential and stated no unauthorized access has been found, but has not confirmed if customers will be notified or if data was accessed prior to discovery.

Editor’s Analysis & Impact

This incident underscores the persistent cybersecurity risks faced by large hospitality companies that manage vast amounts of customer data. The discovery of a hardcoded password in a mobile app points to potential gaps in Wyndham’s secure development lifecycle and vulnerability management processes. While the company has acted to revoke the credential, the lack of transparency regarding potential data exfiltration and future notification plans raises concerns among consumers and regulators. The reliance on external researchers to identify such critical flaws suggests a need for Wyndham to establish robust internal security protocols and a clear vulnerability disclosure program. This event could lead to increased scrutiny from data protection authorities and potentially impact customer trust.

Frequently Asked Questions

Q: What kind of data was exposed in the Wyndham security incident?
A: The exposed data included customer names, email addresses, Wyndham member numbers, and login tokens (JWTs) used to keep users logged into the app. Internal Wyndham files and documents were also present in the database.

Q: How was the security vulnerability discovered?
A: A security researcher, Robert Wiggins, found a password embedded directly in the source code of Wyndham's Android app. This 'hardcoded' password granted access to an internal company database.

Q: What is 'hardcoding' in the context of app security?
A: Hardcoding refers to the practice of embedding sensitive information, such as passwords or API keys, directly into the source code of an application. This is considered a poor security practice because anyone with access to the app's code can easily extract these credentials.