# SZB-f701b8b81b: Wyndham exposes customer data through hardcoded credential in customer app

TechCrunch reports, citing an exclusive, that Wyndham left a hardcoded credential in its customer app, which would let anyone access customer data.

- Type: Breach
- Status: Confirmed
- Vendor: Wyndham
- Product: customer app
- Disclosed: 2026-11-09 23:03 UTC
- Data taken: Names, Email addresses
- Sources: 1 distinct
- First seen by cve.now: 2026-11-09 23:04 UTC · Updated: 2026-11-09 23:10 UTC

Written by a model from the sources below. Verify against them.

## Summary

Wyndham would not say whether it can check for any past unauthorized access.

## What to do

- Expect phishing that uses this breach; verify messages that mention it · For email addresses
- Monitor accounts linked to Wyndham for unusual activity or unexpected notifications
- Change your Wyndham account password and enable multi-factor authentication if offered
- Ask Wyndham whether your personal data was accessed and what it is doing about it

## Timeline

- 2026-11-09 23:03 UTC: Made public by TechCrunch Security
- 2026-11-09 23:03 UTC: Confirmed by Wyndham. TechCrunch Security: “Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access…” ([source](https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/))
- 2026-11-09 23:04 UTC: First seen by cve.now

## What was taken

- Names, Email addresses: [TechCrunch Security](https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/): “Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses, and Wyndham member number.”

## Evidence (1 source)

- 2026-11-09 · Press · [TechCrunch Security](https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/): “Exclusive: Wyndham left a hardcoded credential in its customer app, allowing anyone to access customer data.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-f701b8b81b&body=https%3A%2F%2Fcve.now%2FSZB-f701b8b81b%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the Wyndham breach

### Was Wyndham breached?

Yes. Wyndham says so: “Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a bug that allowed anyone to access customers’ personal information.” (TechCrunch Security).

Source: https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/

### What data was exposed?

Names, Email addresses.

### What should Wyndham customers do?

Expect phishing that uses this breach; verify messages that mention it. Monitor accounts linked to Wyndham for unusual activity or unexpected notifications. Change your Wyndham account password and enable multi-factor authentication if offered. Ask Wyndham whether your personal data was accessed and what it is doing about it.

## Related

- Started as early warning SZB-f701b8b81b, first seen 2026-11-09 23:04 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-f701b8b81b
Site guide for agents: https://cve.now/llms.txt