A hardcoded password discovered in Wyndham's Android app source code exposed an internal database containing customer records and login tokens.
Learn about the incident and how the credential was identified and revoked.
The code gave access to an internal company database hosted on Salesforce. Security researcher Robert Wiggins found that the database contained millions of records, although the exact number of customers affected could not be determined. Wyndham has about 129 registered members in its loyalty programs.
What did the database contain?
The files contained personal customer information, including names, email addresses, and Wyndham membership numbers. They also stored users' digital login keys, as well as internal company documents and records.
The researcher used artificial intelligence tools to identify the code, similar to a recent discovery he made in the Applebee's app.
How was the company notified?
Because Wyndham doesn't have a direct way for researchers to report security issues to it, Wiggins enlisted the help of news website TechCrunch to contact it.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
France accuses Iran of cyberattack on 700 supermarkets that destroyed food
↗
When reporters contacted the company's security department, the code was immediately revoked. A Wyndham spokesperson said there was no indication of unauthorized access, but did not provide further details.
The company did not disclose whether it has the technical means, such as logs, to check for any past accesses, how long the code was exposed, or whether it plans to notify customers and relevant authorities in the United States.
Wyndham's security director, Michael Francess, said investigators can send notifications to an email address, but the company did not confirm whether it plans to create a formal problem-reporting program or change its website.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)