Security researcher Robert Wiggins of What Security told TechCrunch that he found a password inside the source code of Wyndham's Android app that granted access to an internal company database hosted by Salesforce, according to TechCrunch (Zack Whittaker, 9 Nov 2026).

Wiggins told TechCrunch the credential exposed personal information including customer names, email addresses and Wyndham member numbers, and that the database also stored customer login tokens (JWTs) and Wyndham files and documents; according to Wiggins, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records.

TechCrunch says the exposed credential was revoked soon after it contacted Wyndham's cybersecurity staff. A Wyndham spokesperson told TechCrunch: "Our team has taken steps to address the issue" and "Our security teams have no evidence of any unauthorized access."

According to TechCrunch, the spokesperson would not say whether Wyndham had the technical means, such as server logs, to determine whether anyone accessed the database before the discovery, or whether it plans to notify customers or regulators. (source: TechCrunch)