Wyndham’s App Had a Password Hiding Inside It. Here’s What Hotel Guests Should Do Now

Imagine a hotel that tapes the master key to the outside of the front door, then acts surprised when someone notices. That’s roughly what a security researcher says he found inside the Wyndham app for Android phones.

According to an exclusive TechCrunch report published November 9, researcher Robert Wiggins of What Security found a working password sitting inside the app’s code. That password opened an internal Wyndham customer database, hosted by the business software company Salesforce. Wyndham, the company behind brands like Wyndham Garden, says it has taken steps to address the issue, and that password has since been shut off. What the company won’t say is whether anyone else found that key first.

If you’ve ever stayed at a Wyndham hotel, joined its rewards program, or used its app, here’s what happened in plain English, what’s still unknown, and the short list of things worth doing this week, right as holiday travel booking kicks into high gear.

What happened, minus the tech-speak

Every app on your phone is a package of instructions. Anyone with a copy of the app and the right free tools can unpack it and read a lot of what’s inside. That’s why app makers are supposed to keep passwords out of the package entirely. When a password is baked right into the app, security folks call it “hardcoding,” and TechCrunch notes that hardcoded credentials are often given the highest possible severity score, because anyone can pull them out and use them.

Wiggins told TechCrunch that the password unlocked a database holding:

• Customer names
• Email addresses
• Wyndham member numbers
• Login tokens that keep customers signed in to the app without retyping their password
• Internal Wyndham files and documents

Those login tokens deserve a quick translation. Think of a token as the wristband you get at a water park. Once it’s on, nobody asks for your ticket again. Handy for you, and handy for anyone who manages to copy your wristband.

Wiggins said the database had millions of entries, but he couldn’t pin down how many customer records were exposed. For scale, Wyndham says it has about 129 million rewards members. That doesn’t mean 129 million people were affected. It means nobody outside the company knows the real number yet.

What Wyndham says, and what it won’t say

Wiggins said Wyndham had no obvious way for outsiders to report security bugs, so he asked TechCrunch to help get the company’s attention. Soon after TechCrunch contacted Wyndham’s security staff, the exposed password was shut off.

A Wyndham spokesperson told TechCrunch, “Our team has taken steps to address the issue,” and “Our security teams have no evidence of any unauthorized access.” That’s good to hear, but the spokesperson wouldn’t say:

• Whether Wyndham has the records, such as server logs, to know if anyone else got in before the researcher did
• How long the password was sitting inside the app
• Whether customers will be notified
• Whether the company will report the incident to regulators like the U.S. Securities and Exchange Commission

“No evidence” isn’t quite the same as “it didn’t happen.” It’s a bit like a store saying it saw no shoplifters, when nobody can tell you whether the security cameras were recording. The cybersecurity site Cyberpresso summed up the same gap: Wyndham revoked the password but won’t say if anyone used it first.

This keeps happening, and AI is part of why

This is the second time in two weeks the same researcher has found this exact kind of mistake in a big brand’s app. In late October, TechCrunch reported that Applebee’s Android app also carried a password to its customer database. That one exposed names, email addresses, birth dates, phone numbers, ZIP codes, veteran status, and the IP addresses of recent logins, which can reveal a rough location. Malwarebytes also covered the Applebee’s lapse and noted that details like these can help scammers make their messages look relevant and convincing.

Here’s the twist: Wiggins used AI tools for both discoveries. TechCrunch explains that AI makes it easier to scan thousands of lines of unpacked app code for simple mistakes like a leftover password. That’s great when a good-faith researcher is doing the looking. The uncomfortable part is that the same shortcut is available to people with worse intentions.

Travel data in general is having a rough fall, too. The Record reports that several airlines, including Japan Airlines, Cathay Pacific, Korean Air, and Singapore Airlines, have disclosed breaches traced back to Amadeus, a company that runs booking and check-in systems for airlines. Cybernews adds that Finnair says about 116,000 of its bookings were involved, and that Amadeus says no credit card numbers or passwords were accessed. That’s a separate incident from Wyndham’s, but the lesson is the same: your booking details are sitting in a lot of computers you’ll never see.

The real risk: very convincing fake emails

The list of exposed data that was reported doesn’t mention payment card numbers. The bigger worry is what a crook could do with your name, email address, and member number. That combo is perfect for a phishing email, which is a fake message designed to trick you into clicking a link, logging in on a fake page, or handing over information.

Picture this: an email lands that greets you by name, quotes your real Wyndham member number, and warns that your points will expire unless you “verify your account” today. It looks legit because some of the details are legit. We saw the same trick with fake Frontier emails that included real flight booking codes. Real details in a message prove nothing about who sent it.

The Cybersecurity and Infrastructure Security Agency (CISA, the federal government’s cyber defense agency) lists the warning signs: urgent or scary language, requests for personal or financial information, shortened links you don’t trust, and lookalike email addresses or web links. CISA also points out that bad grammar used to be a giveaway, but in the age of AI, scam emails can have perfect spelling. So don’t count on typos to save you.

What to do this week

None of this requires a computer science degree. Here’s the plain list:

1. Change your Wyndham Rewards password, especially if you use the app. If you used that same password anywhere else, change it there too. A password manager makes unique passwords painless.
2. Don’t click links in “Wyndham” emails or texts for a while. If a message says something is wrong with your account or points, open the official app or type the website address yourself. CISA’s advice is to contact the company through a verified channel, not a link or phone number in the message.
3. Check your points and recent stays. Rewards points have real value, so treat them like a gift card balance. If anything looks off, contact Wyndham through its official website.
4. Keep the app updated, or delete it if you rarely use it. Fewer apps holding your logins means fewer places for a slip-up like this.
5. Turn on two-step login wherever it’s offered, starting with your email account. Your inbox is the master key to password resets for everything else.
6. See where your email has already leaked. The free site Have I Been Pwned shows which known breaches include your address, so you know what kind of scams to expect.
7. Tell the family. The person most likely to fall for a polished fake points email is the one who doesn’t read tech news. Forward them this article.

Why it matters to you

Thanksgiving and holiday trips are being booked right now, which means travel emails are flooding inboxes. That’s exactly when a well-timed fake “your reservation needs attention” message works best, because you’re expecting messages like it.

The bigger takeaway is that you can’t control whether a giant company leaves a password inside its app. You can control what happens next. A unique password, a healthy suspicion of links, and a strong second login step turn a leaked email address from a disaster into a shrug. It’s the difference between a burglar knowing your address and a burglar actually getting inside.

And if you get a strange Wyndham message, you don’t have to figure it out alone. Go to the source directly, and when in doubt, don’t click.

What I’d grab

You don’t need to buy anything to stay safe here. If you want an extra layer, these two genuinely help:

• Yubico YubiKey 5 NFC security key: a physical key you tap or plug in to log in. Fake login pages can’t trick it, which is exactly the attack a leaked email list invites. Start with your email account.
• GL.iNet Beryl AX (GL-MT3000) travel router: if you’re staying in hotels this holiday season, this puts your phone and laptop on your own private network instead of sharing the hotel Wi-Fi directly with every other guest.

As an Amazon Associate I earn from qualifying purchases.

Got a suspicious travel email you’re not sure about? Tell me about it on the Contact Us page, and I may cover it in a future post.

Want the 60-second version of stories like this? Catch my daily tech shorts on YouTube.

Sources

• TechCrunch: Hotel giant Wyndham exposed customer data after app security lapse (Nov. 9, 2026)
• Cyberpresso: report on the password left in Wyndham’s Android app
• TechCrunch: Applebee’s exposed customers’ personal data after leaving database password in app (Oct. 30, 2026)
• Malwarebytes: Applebee’s customer data exposed by password left in app (November 2026)
• The Record: More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus
• Cybernews: Finnair data breach hits 116,000 bookings via Amadeus (Nov. 10, 2026)
• CISA: Recognize and Report Phishing