How to tell if your Wyndham account data was exposed
Quick answer: A security researcher found a password stored inside Wyndham’s Android app that unlocked an internal customer database. It held names, email addresses, Wyndham member numbers and the login tokens that keep people signed in to the app. Wyndham revoked the password after TechCrunch contacted it and says its “security teams have no evidence of any unauthorized access.” It has not said whether it can check past access, whether it will notify customers, or how many people are affected. Wyndham says it has about 129 million rewards members. (TechCrunch, Nov 9)
What happened
- Researcher Robert Wiggins of What Security found a password inside the source code of the Wyndham Android app. It gave access to an internal Wyndham database hosted on Salesforce.
- Wiggins told TechCrunch the database had millions of entries but he could not determine how many were customer records.
- Wyndham had no way for outsiders to report security flaws, so he asked TechCrunch to help alert the company. Soon after TechCrunch reached Wyndham’s cybersecurity staff, the credential was revoked, which stops further access through it.
- This is the second hardcoded-credential find by Wiggins in two weeks; the first was in Applebee’s app. (All per TechCrunch.)
Am I affected?
- Who could be: people with a Wyndham account or Wyndham Rewards membership whose records sat in that database. The count is not known.
- What the researcher says was exposed: names, email addresses, Wyndham member numbers, customer login tokens (JWTs) and company files and documents.
- What was not reported as exposed: TechCrunch’s report does not mention payment card numbers or passwords.
- What Wyndham says: “Our team has taken steps to address the issue” and “Our security teams have no evidence of any unauthorized access.”
- What Wyndham did not say: how long the password was in the app, whether it has server logs that could show earlier access, whether it will notify customers or file with U.S. regulators, or how it will ship a long-term fix.
So “no evidence” is not the same as “no access.” Nobody outside Wyndham can confirm whether anyone else used the password before it was revoked.
How to check
- Watch your inbox, including spam, for a notice from Wyndham about a security incident. As of Nov 10, 2026, Wyndham has not said it will send one.
- Check your account activity. Sign in at the Wyndham website and look for bookings, point transfers or profile changes you don’t recognize.
- Search your email for the address you use with Wyndham for unexpected Wyndham-looking messages. Exposed names, emails and member numbers make a believable phishing email easier to write.
What to do
These are our practical suggestions, not Wyndham instructions:
- Sign out of the Wyndham app and sign back in. Login tokens are what keep you signed in. Signing out ends your current session on that device; whether Wyndham invalidated tokens on its side is not stated.
- Change your Wyndham password if you reuse it anywhere, and turn on two-factor sign-in if Wyndham offers it for your account.
- Treat unexpected “your reservation” or “points” messages as suspect. Don’t click links in them. Open the app or type the website address yourself.
- Keep the app updated, since Wyndham has not yet said how it will fix the app itself.
FAQ
Was my credit card exposed? TechCrunch’s report does not say card data was in the database. Wyndham has not detailed what the database held beyond what the researcher described.
Is it only Android users? The password was found in the Android app. The database it opened is a company system, so the people in it are not necessarily Android users. Wyndham has not said.
Did hackers get in? Wyndham says it has no evidence of unauthorized access. It would not say whether it can see earlier activity.
How many people are affected? Unknown. Wyndham lists about 129 million enrolled rewards members, but the number of records exposed has not been determined.
Where do researchers report problems? Wyndham’s cybersecurity director told TechCrunch to write [email protected].
Sources
- TechCrunch, “Hotel giant Wyndham exposed customer data after app security lapse” (Nov 9, 2026, 3:03 p.m. PST / 5:03 p.m. CT): https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/
— AltTab Dad