Wyndham exposes customer data through hardcoded credential in customer app
TechCrunch reports, citing an exclusive, that Wyndham left a hardcoded credential in its customer app, which would let anyone access customer data.
Written by a model from the sources below. Verify against them.
- Vendor
- Wyndham
- Product
- customer app
- Status
- Confirmed
- Disclosed
- Data taken
- Names, Email addresses
Summary
Wyndham would not say whether it can check for any past unauthorized access.
What to do
Expect phishing that uses this breach; verify messages that mention it
For email addressesMonitor accounts linked to Wyndham for unusual activity or unexpected notifications
Change your Wyndham account password and enable multi-factor authentication if offered
Ask Wyndham whether your personal data was accessed and what it is doing about it
Timeline
- Made public by TechCrunch Security
- Confirmed by Wyndham
TechCrunch Security: “Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access…”
- First seen by cve.now
What was taken
| Taken | Per the source |
|---|---|
| Names, Email addresses | TechCrunch Security: “Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses, and Wyndham member number.” |
Evidence 1
- PressTechCrunch Security
“Exclusive: Wyndham left a hardcoded credential in its customer app, allowing anyone to access customer data.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Wyndham breach
Was Wyndham breached?
Yes. Wyndham says so: “Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers’ personal information.” (TechCrunch Security).
What data was exposed?
Names, Email addresses.
What should Wyndham customers do?
Expect phishing that uses this breach; verify messages that mention it. Monitor accounts linked to Wyndham for unusual activity or unexpected notifications. Change your Wyndham account password and enable multi-factor authentication if offered. Ask Wyndham whether your personal data was accessed and what it is doing about it.