On 9 November 2026, TechCrunch reported that the hotel group Wyndham had exposed customer data because a password was hardcoded in its Android app. According to TechCrunch, security researcher Robert Wiggins of What Security found the credential and it gave access to an internal database hosted by Salesforce. The database held customer names, email addresses, Wyndham member numbers, login tokens (JWTs) that keep customers signed in, and Wyndham files and documents. It contained millions of entries, but the number of customer records exposed is not known. TechCrunch says the credential was revoked after it contacted Wyndham's cybersecurity staff. A Wyndham spokesperson told TechCrunch that its security teams have no evidence of any unauthorised access. Wyndham has not said how long the password was in the app or whether it can check logs for past access. The same researcher reported a near-identical flaw in Applebee's app two weeks earlier. Reporting so far rests on TechCrunch alone.
Key takeaways
- According to TechCrunch, a password hardcoded in Wyndham's Android app gave anyone who extracted it access to an internal Salesforce-hosted database of customer data.
- The exposed data included customer login tokens (JWTs), names, email addresses and member numbers, TechCrunch reports. Wyndham cites about 129 million enrolled rewards members, but the number of records exposed is unknown.
- The credential was revoked after TechCrunch contacted Wyndham. Wyndham says it has "no evidence of any unauthorized access" and has not said whether logs exist to check.
- This is an exposure with no confirmed misuse, reported by TechCrunch and followed up by TechRadar, which relies on the same researcher. The researcher found a near-identical credential in Applebee's app two weeks earlier, using AI tools to scan decompiled code.
- The identity lesson: a backend credential shipped inside a mobile app is a public credential. Anyone can download and decompile the app, so the app itself must never hold a key to the database.
At a glance
| Organisation | Wyndham Hotels and Resorts and its rewards members |
|---|---|
| When | Exposure period not disclosed; credential revoked after TechCrunch contacted Wyndham; first public report 9 November 2026 |
| Attacker | None known. Found by security researcher Robert Wiggins of What Security, according to TechCrunch |
| Entry point | A password hardcoded in Wyndham's Android app, recoverable by decompiling the app |
| Identities abused | Exposed, not confirmed abused: the hardcoded database credential, and customer login tokens (JWTs) stored in the database |
| Impact | Customer names, email addresses, member numbers, login tokens and company files were accessible; record count unknown; Wyndham says no evidence of unauthorised access; no confirmed misuse |
| Category | NHI. Incident class: exposure, no confirmed misuse (hardcoded app credential found by a researcher) |
What happened
Mobile apps often need to talk to backend services, and the safe way to do that is through an API that checks each user's own session. The unsafe way is to ship a service credential inside the app. According to TechCrunch, Wyndham's Android app did the second: it contained a hardcoded password that granted access to an internal Wyndham database hosted by Salesforce. Robert Wiggins of What Security found it. TechCrunch reports that Wiggins used AI tools, which help scan large volumes of decompiled app code, for this discovery and for a similar one at Applebee's.
TechCrunch says the database held customer names, email addresses and Wyndham member numbers, along with login tokens, known as JWTs, that keep customers signed in to their accounts, and Wyndham files and documents. The database contained millions of entries, but Wiggins could not determine how many customer records were exposed. For scale, TechCrunch notes that Wyndham cites about 129 million enrolled rewards members. That figure is the size of the programme, not a count of exposed records. Exposed login tokens matter because a valid session token can stand in for a customer's password until it expires or is revoked; Wyndham has not said whether the exposed tokens were invalidated.
After TechCrunch contacted Wyndham's cybersecurity staff, the credential was revoked. A Wyndham spokesperson told TechCrunch: "Our security teams have no evidence of any unauthorized access," without offering details. TechCrunch reports that Wyndham would not say whether it can check server logs for past access, whether it will notify customers or report to US regulators such as the SEC, how long the password was in the app, when a long-term fix will ship, or whether it will set up a vulnerability disclosure programme. Michael Francess, Wyndham's cybersecurity director, said researchers can email the company's security contact with issues. Wiggins told TechCrunch that without visibility into past activity, malicious actors could have taken large amounts of data. That is a possibility, not a finding.
On 11 November 2026 we found no statement from Wyndham on its own channels and no independent report beyond TechCrunch's, so every incident fact on this page is attributed to TechCrunch. It is not the first time TechCrunch has reported on Wyndham security: in May 2024 it reported consumer-grade spyware running on the check-in computers of at least three Wyndham-branded hotels, which Wyndham said are independently owned. That earlier incident is unrelated in cause. This page will be updated if Wyndham publishes its own account.
Timeline
| Date | Event |
|---|---|
| 22 May 2024 | TechCrunch reports spyware on check-in computers at Wyndham-branded hotels (unrelated earlier incident). |
| 30 October 2026 | TechCrunch reports a near-identical hardcoded database password found by the same researcher in Applebee's Android app. |
| November 2026 | TechCrunch contacts Wyndham's cybersecurity staff and the hardcoded credential is revoked (exact date not disclosed). |
| 9 November 2026 | TechCrunch publishes its report; Wyndham says it has no evidence of unauthorised access. |
| 10 November 2026 | TechRadar reports Wyndham's confirmation that the issue was addressed and Wyndham's figure of 129 million enrolled rewards members; it says Wyndham does not appear to have told affected customers. |
How it happened: the identity attack path
- A service credential ships in the app. A password for a backend database was built into Wyndham's Android app, according to TechCrunch, so every copy of the app on every phone carried it.
- The app is decompiled. Android apps can be downloaded and decompiled by anyone. The researcher used AI tools to scan the decompiled code at scale and found the credential.
- The credential opens the database. The password granted access to an internal Salesforce-hosted database, bypassing the per-customer checks that a normal app login would enforce.
- Stored tokens widen the exposure. The database held customer login tokens (JWTs) as well as personal data. A machine credential that reaches stored session tokens can, in principle, reach customer accounts too.
- Revocation, with history unknown. Wyndham revoked the credential after TechCrunch made contact. It has not said how long the password was exposed or whether logs show past use, so it is not possible to rule access in or out from public information.
Impact
- Confirmed exposure (according to TechCrunch): customer names, email addresses, member numbers, login tokens (JWTs) and Wyndham files and documents in a database of millions of entries.
- Company position: Wyndham says its security teams have no evidence of any unauthorised access and, according to TechRadar, that its "team has taken steps to address the issue". TechRadar notes Wyndham says it has 129 million enrolled rewards members, which does not show how many were affected, and that Wyndham does not appear to have told affected customers. It has not said whether it has the logs to establish that.
- Not confirmed: any access by anyone other than the researcher and TechCrunch, the number of customers affected, and whether exposed tokens were invalidated.
- Potential: if the credential was found by others, account takeover using stored session tokens and targeted phishing using names, emails and member numbers.
- Disclosure: Wyndham would not say whether it will notify customers or regulators, according to TechCrunch.
What this means for NHI governance
This belongs on an NHI list because the root cause is a machine credential in the wrong place. The password in the app was not a customer's password. It was a service credential for a backend database, the kind of non-human identity that should live in a server-side secrets store and never leave it. Once it was compiled into a public app, it was effectively published to everyone who downloaded the app. The same pattern appeared at Applebee's two weeks earlier, found by the same researcher.
The second lesson is about what the credential could reach. A database that stores customers' login tokens turns a single leaked service credential into a path to many customer sessions. Session tokens should be short-lived, bound to the device or client where possible, and not stored in places that broad service credentials can read. Our Mobile App Security Guide and JWT Security Guide cover both sides, and the OWASP NHI Top 10 NHI2 Secret Leakage Guide explains why hardcoded secrets keep recurring.
The researcher's use of AI tools to scan decompiled code is also worth noting. Finding secrets in mobile apps used to take time per app. If tools make it fast, defenders should assume that any credential in a shipped binary will be found, and test their own apps the same way before release.
Recommendations
- Remove backend credentials from mobile apps. Route app traffic through an API that authenticates each user, and keep database and service credentials on the server side only. See our Mobile App Security Guide.
- Scan your own app binaries before attackers do. Decompile release builds and scan them for secrets as part of every release, including older versions still in app stores. See our Mobile App Security Testing Guide.
- Revoke, rotate and invalidate together. When a credential is exposed, revoke it, rotate anything it could read, and invalidate customer session tokens that sat in the reachable data. See our JWT Security Guide.
- Keep the logs that answer "was it used?". Log access by service credentials to customer data stores, and retain those logs long enough to cover how long an app version stays installed. See How to review Salesforce connected apps and integration users.
- Give researchers a clear reporting route. Publish a security contact and a vulnerability disclosure policy so findings reach the right team quickly. See our Bug Bounty and Vulnerability Disclosure Guide.
- Manage app-embedded secrets as NHIs. Inventory every credential your client apps use, assign an owner and set scope and expiry. See our Secrets Management Guide.
Frequently asked questions
Was Wyndham hacked in 2026?
There is no confirmed hack. According to TechCrunch, a researcher found a password hardcoded in Wyndham's Android app that gave access to a customer database, and Wyndham revoked it after TechCrunch made contact. Wyndham says its security teams have no evidence of any unauthorised access, but it has not said whether it has logs covering the whole period the password was exposed.
What Wyndham customer data was exposed?
TechCrunch reports that the database held customer names, email addresses, Wyndham member numbers, login tokens (JWTs) that keep customers signed in, and Wyndham files and documents. The number of customers affected is not known. Wyndham has not said whether it will notify customers. Members should be wary of unexpected messages about their account and sign in through the official app or website.
Why is a hardcoded password in an app dangerous?
Anyone can download a mobile app and decompile it, so any password built into it is effectively public. If that password opens a backend database, everyone who finds it gets the same access as the app's service account, without needing a customer login. Backend credentials belong on servers, behind an API that checks each user's own session.
Related NHI Mgmt Group resources
Applebee's breach 2026 · Salesloft Drift Breach 2025 · Mobile App Security Guide · JWT Security Guide · OWASP NHI Top 10 NHI2 Secret Leakage Guide
How NHI Mgmt Group can help
Service credentials end up in apps, scripts and repositories because nobody owns them end to end. NHI Mgmt Group helps organisations find where machine credentials live, including inside client applications, move them into proper secrets management, and put ownership, rotation and logging around them so that questions like "was it used?" can be answered. See our NHI and AI agent security training.
References
- TechCrunch: Spyware found on US hotel check-in computers (22 May 2024)
- TechCrunch: Applebee's exposed customers' personal data after leaving database password in app (30 October 2026)
- TechCrunch: Hotel giant Wyndham exposed customer data after app security lapse (9 November 2026)
- TechRadar: Wyndham confirms it exposed hotel customer data after expert finds flaw in app security (10 November 2026)