If you’ve ever stayed at a Wyndham hotel, joined its rewards program, or used its app, here’s what happened in plain English, what’s still unknown, and the short list of things worth doing this week, right as holiday travel booking kicks into high gear.<\/p>\n\n\n\n Every app on your phone is a package of instructions. Anyone with a copy of the app and the right free tools can unpack it and read a lot of what’s inside. That’s why app makers are supposed to keep passwords out of the package entirely. When a password is baked right into the app, security folks call it “hardcoding,” and TechCrunch notes that hardcoded credentials are often given the highest possible severity score, because anyone can pull them out and use them.<\/p>\n\n\n\n Wiggins told TechCrunch that the password unlocked a database holding:<\/p>\n\n\n\n Those login tokens deserve a quick translation. Think of a token as the wristband you get at a water park. Once it’s on, nobody asks for your ticket again. Handy for you, and handy for anyone who manages to copy your wristband.<\/p>\n\n\n\n Wiggins said the database had millions of entries, but he couldn’t pin down how many customer records were exposed. For scale, Wyndham says it has about 129 million rewards members. That doesn’t mean 129 million people were affected. It means nobody outside the company knows the real number yet.<\/p>\n\n\n\n Wiggins said Wyndham had no obvious way for outsiders to report security bugs, so he asked TechCrunch to help get the company’s attention. Soon after TechCrunch contacted Wyndham’s security staff, the exposed password was shut off.<\/p>\n\n\n\n A Wyndham spokesperson told TechCrunch, “Our team has taken steps to address the issue,” and “Our security teams have no evidence of any unauthorized access.” That’s good to hear, but the spokesperson wouldn’t say:<\/p>\n\n\n\n “No evidence” isn’t quite the same as “it didn’t happen.” It’s a bit like a store saying it saw no shoplifters, when nobody can tell you whether the security cameras were recording. The cybersecurity site Cyberpresso<\/a> summed up the same gap: Wyndham revoked the password but won’t say if anyone used it first.<\/p>\n\n\n\n This is the second time in two weeks the same researcher has found this exact kind of mistake in a big brand’s app. In late October, TechCrunch reported<\/a> that Applebee’s Android app also carried a password to its customer database. That one exposed names, email addresses, birth dates, phone numbers, ZIP codes, veteran status, and the IP addresses of recent logins, which can reveal a rough location. Malwarebytes<\/a> also covered the Applebee’s lapse and noted that details like these can help scammers make their messages look relevant and convincing.<\/p>\n\n\n\n Here’s the twist: Wiggins used AI tools for both discoveries. TechCrunch explains that AI makes it easier to scan thousands of lines of unpacked app code for simple mistakes like a leftover password. That’s great when a good-faith researcher is doing the looking. The uncomfortable part is that the same shortcut is available to people with worse intentions.<\/p>\n\n\n\n Travel data in general is having a rough fall, too. The Record<\/a> reports that several airlines, including Japan Airlines, Cathay Pacific, Korean Air, and Singapore Airlines, have disclosed breaches traced back to Amadeus, a company that runs booking and check-in systems for airlines. Cybernews<\/a> adds that Finnair says about 116,000 of its bookings were involved, and that Amadeus says no credit card numbers or passwords were accessed. That’s a separate incident from Wyndham’s, but the lesson is the same: your booking details are sitting in a lot of computers you’ll never see.<\/p>\n\n\n\n The list of exposed data that was reported doesn’t mention payment card numbers. The bigger worry is what a crook could do with your name, email address, and member number. That combo is perfect for a phishing email, which is a fake message designed to trick you into clicking a link, logging in on a fake page, or handing over information.<\/p>\n\n\n\n Picture this: an email lands that greets you by name, quotes your real Wyndham member number, and warns that your points will expire unless you “verify your account” today. It looks legit because some of the details are legit. We saw the same trick with fake Frontier emails that included real flight booking codes<\/a>. Real details in a message prove nothing about who sent it.<\/p>\n\n\n\n The Cybersecurity and Infrastructure Security Agency<\/a> (CISA, the federal government’s cyber defense agency) lists the warning signs: urgent or scary language, requests for personal or financial information, shortened links you don’t trust, and lookalike email addresses or web links. CISA also points out that bad grammar used to be a giveaway, but in the age of AI, scam emails can have perfect spelling. So don’t count on typos to save you.<\/p>\n\n\n\n None of this requires a computer science degree. Here’s the plain list:<\/p>\n\n\n\n Thanksgiving and holiday trips are being booked right now, which means travel emails are flooding inboxes. That’s exactly when a well-timed fake “your reservation needs attention” message works best, because you’re expecting messages like it.<\/p>\n\n\n\n The bigger takeaway is that you can’t control whether a giant company leaves a password inside its app. You can control what happens next. A unique password, a healthy suspicion of links, and a strong second login step turn a leaked email address from a disaster into a shrug. It’s the difference between a burglar knowing your address and a burglar actually getting inside.<\/p>\n\n\n\n And if you get a strange Wyndham message, you don’t have to figure it out alone. Go to the source directly, and when in doubt, don’t click.<\/p>\n\n\n\n You don’t need to buy anything to stay safe here. If you want an extra layer, these two genuinely help:<\/p>\n\n\n\n As an Amazon Associate I earn from qualifying purchases.<\/p>\n\n\n\n Got a suspicious travel email you’re not sure about? Tell me about it on the Contact Us page<\/a>, and I may cover it in a future post.<\/p>\n\n\n\n Want the 60-second version of stories like this? Catch my daily tech shorts on YouTube<\/a>.<\/p>\n\n\n\n A password left in Wyndham’s Android app exposed guest names, emails, and member numbers. Here’s what it means and 7 easy steps to stay safe.<\/p>\n","protected":false},"author":1,"featured_media":802,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73],"tags":[167,105,123,121,188,192,290,291,168,292,289,288],"class_list":["post-805","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech","tag-2fa","tag-android","tag-cybersecurity","tag-data-breach","tag-email-scam","tag-holiday-travel","tag-hotel-rewards","tag-password-security","tag-phishing","tag-security-key","tag-travel-scams","tag-wyndham"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t![\"A](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/wyndham-garden-hotel-fresno.jpg\")
What happened, minus the tech-speak<\/h2>\n\n\n\n
\n
What Wyndham says, and what it won’t say<\/h2>\n\n\n\n
\n
This keeps happening, and AI is part of why<\/h2>\n\n\n\n
The real risk: very convincing fake emails<\/h2>\n\n\n\n
![\"A](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/example-phishing-email.png\")
What to do this week<\/h2>\n\n\n\n
\n
Why it matters to you<\/h2>\n\n\n\n
![\"A](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/yubikey-5-nfc-security-key.png\")
What I’d grab<\/h2>\n\n\n\n
\n
Sources<\/h2>\n\n\n\n
\n