Wyndham data breach guide: smartphone, blank hotel key card, sunglasses and a small red USB stick on a bright hotel nightstand

Wyndham Data Exposure: What Rewards Members Should Do

RedKey USB

By RedKey USB. Published November 10, 2026. Facts about the incident come from TechCrunch's report, which includes Wyndham's statement and the researcher's account. Security steps come from CISA, Apple, Google and the FTC. All are linked in the sources. RedKey is not affiliated with Wyndham.

Quick answer: Wyndham data breach or data exposure?

  • What happened: a researcher found a password inside Wyndham's Android app that opened an internal company database hosted by Salesforce.[1]
  • What was exposed: customer names, email addresses, Wyndham member numbers and app login tokens, plus Wyndham files and documents, according to the researcher.[1]
  • Wyndham's response: the password was revoked after TechCrunch contacted Wyndham, and the company says it has no evidence of any unauthorized access.[1]
  • What is unknown: how many members were in the database, how long the password was in the app, and whether anyone else used it.[1]
  • What to do: sign out of the Wyndham app and back in, change your Wyndham Rewards password, watch for phishing, and wipe old phones before selling them.[2][3][4][5]

Is this a Wyndham data breach? Hotel group Wyndham has acknowledged a cybersecurity incident after a security researcher found that a password left inside its Android app gave anyone who found it access to customer data. Wyndham says it has fixed the problem and has no evidence that anyone else got in, but it has not said whether it can rule that out. This guide covers what is confirmed, what Wyndham Rewards members should do now, and why travel and loyalty apps should be cleared off old phones before they are sold.

What happened in the Wyndham data exposure?

Security researcher Robert Wiggins of What Security told TechCrunch that he found a password inside the source code of Wyndham's Android app. The password granted access to an internal company database hosted by Salesforce.[1] Wiggins said Wyndham had no way to report security flaws, so he asked TechCrunch to help alert the company. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked, preventing further access to the database.[1]

Putting a password directly inside a public app is known as hardcoding. TechCrunch explains that anyone with a copy of the app can extract such a password and use it to reach the server or database behind it.[1] Wiggins told TechCrunch he used AI tools to find the flaw, and that it was his second discovery of hardcoded credentials in two weeks, after a similar issue in Applebee's app.[1]

What data was exposed?

According to Wiggins, the database contained:[1]

  • Customer names
  • Email addresses
  • Wyndham member numbers
  • Customer login tokens, known as JWTs, which keep people signed in to the app without entering their password each time
  • Wyndham files and documents

TechCrunch's report does not list passwords, payment card numbers or Social Security numbers among the exposed data.[1] The login tokens are the most sensitive item for members, because a token is what keeps an app session signed in.

How many Wyndham Rewards members are affected?

That is not known. Wiggins said the database had millions of entries, but he was unable to determine an accurate number of exposed customer records.[1] TechCrunch notes that Wyndham touts some 129 million enrolled rewards members.[1] That is the size of the program, not a count of affected people, so do not read it as 129 million records exposed.

Is it a Wyndham data breach or a data exposure?

The difference matters. A data exposure means information was reachable by people who should not have had access. A breach usually means someone actually got in and took it. Here, what is confirmed is the exposure: a working password sat in a public app.[1]

A Wyndham spokesperson told TechCrunch that its team had taken steps to address the issue and that its security teams have no evidence of any unauthorized access.[1] The spokesperson would not say whether Wyndham had the technical means, such as server logs, to tell whether anyone accessed the database before Wiggins found the password, or how long the password had been in the app.[1] Wiggins told TechCrunch that without visibility into past activity, someone with malicious intent could have leaked large amounts of customer data.[1] In short: no confirmed misuse, but no way for members to know either way.

Wyndham also would not say whether it plans to notify customers or file a notice with US regulators such as the SEC.[1]

What should Wyndham Rewards members do now?

  1. Sign out of the Wyndham app, then sign back in. The exposed data included login tokens.[1] Signing out and back in gives your device a fresh session. Whether older tokens stop working depends on Wyndham's systems, but it costs nothing.
  2. Change your Wyndham Rewards password. Use a long, unique password and store it in a password manager, as CISA recommends.[2]
  3. Change any reused password. If you used the same password on email or other travel accounts, change those too, starting with your email account.[2]
  4. Turn on multifactor authentication wherever it is offered, especially on the email account linked to your Wyndham Rewards membership.[6]
  5. Check your points and bookings. Look for redemptions, bookings or profile changes you did not make, and report them to Wyndham through its official website or app.
  6. Keep the app updated. Wyndham has not said how it plans to ship a long-term fix for the app.[1] Install app updates as they arrive, and delete the app from any phone you no longer use.

Watch for Wyndham phishing emails

Your name, email address and member number are exactly what a scammer needs to write a convincing fake email about your account, points or a refund. CISA lists urgent language, requests for personal or financial information, shortened links and slightly wrong email addresses as common signs of phishing.[3] If a message about your Wyndham account seems real, do not click its links or call the number in it. Open the app or type the website address yourself.[3] If you do lose money or your identity is misused, IdentityTheft.gov lists recovery steps.[7]

Why travel apps should be cleared off old phones

This incident centered on an app, and it is a reminder of how much travel apps hold. Hotel, airline and booking apps stay signed in for months, store your name, email, member number, upcoming trips and saved payment details, and keep login tokens on the phone itself. When a phone is sold, traded in or handed down with those apps still signed in, the next owner may be able to open them.

Before an old phone leaves your hands:

  1. Back it up. Apple's guide starts with creating a backup, and Google's reset guide says to back up to your Google Account first.[4][5]
  2. Sign out of travel and loyalty apps. Then delete them.
  3. Sign out of your main account. On iPhone, Apple's steps start in Settings, under your name, with Sign Out.[4] On Android, make sure you know the Google Account and password on the phone before resetting.[5]
  4. Erase the phone. Google says a factory reset erases all your data from the phone, and Apple's guide walks through erasing an iPhone or iPad before you sell it.[5][4]

CISA notes that methods of sanitization vary by device, so use the method that applies to the device in front of you.[8] For more detail, see how to erase mobile phones before disposal, does a factory reset remove everything? and can data be taken from a locked phone? Our personal cybersecurity habits checklist covers passwords and sign-ins.

How does RedKey help?

Most people will use their phone's built-in erase. Businesses and repair shops that hand on many phones, tablets and computers often want a consistent process and a record. Wiping phones and tablets is available in RedKey Ultimate only, which also produces a PDF erasure report for each device. For computers and drives, RedKey Home shows the result on screen and RedKey Professional produces a PDF erasure report.

RedKey cannot change anything in Wyndham's systems or protect your Wyndham Rewards account. Signing out, changing your password and watching for phishing are the steps that matter for this incident. RedKey is for the devices you no longer use.

The bottom line

A password in Wyndham's Android app exposed member names, emails, member numbers and login tokens. Wyndham revoked it and says it has no evidence of unauthorized access, but has not said whether it could detect earlier access. Sign out of the app and back in, change your Wyndham Rewards password and any reused passwords, watch for convincing phishing emails, and clear travel apps off old phones before you sell them.

Wyndham data breach FAQs

Is there a Wyndham data breach?

What is confirmed is a data exposure. A security researcher found a password in Wyndham's Android app that gave access to an internal database with customer data. Wyndham acknowledged a cybersecurity incident, revoked the password and told TechCrunch its security teams have no evidence of any unauthorized access. It would not say whether it can check logs for earlier access.

What data was exposed in the Wyndham app?

According to researcher Robert Wiggins, the database held customer names, email addresses, Wyndham member numbers and customer login tokens called JWTs, plus Wyndham files and documents. TechCrunch's report does not list passwords or payment card numbers among the exposed data.

How many Wyndham Rewards members are affected?

Nobody knows yet. Wiggins said the database had millions of entries but he could not determine an accurate number of exposed customer records. Wyndham says it has about 129 million enrolled rewards members, but that is the size of the program, not the number affected.

Will Wyndham notify affected customers?

Wyndham would not tell TechCrunch whether it plans to notify customers or disclose the incident to regulators such as the SEC. If you get a notice, check it by going to Wyndham's website yourself rather than using links in the message.

Should I change my Wyndham Rewards password?

It is a sensible precaution. Use a long, unique password that you do not use anywhere else, and change any other account that shares the same password. Sign out of the Wyndham app and sign back in to refresh your login.

Are Wyndham phishing emails likely?

Exposed names, emails and member numbers are exactly what makes a phishing email look real. Be wary of messages about points, account problems or refunds, and sign in through the app or a website you type in yourself.

Do I need to delete the Wyndham app?

No one has said you need to. Keep the app updated, sign out and back in, and remove it from any phone you no longer use. Wyndham has not said how or when it will ship a long-term fix for the app.

How do I remove travel apps from an old phone before selling it?

Sign out of travel and loyalty apps, sign out of your Apple Account or Google Account, then erase the phone with a factory reset. Apple and Google both publish step-by-step guides for this.

Can RedKey Ultimate wipe phones?

Mobile device wiping is available in RedKey Ultimate only. RedKey Home and Professional wipe computers and drives. RedKey Professional and Ultimate produce a PDF erasure report, and Home shows results on screen.

Sources

  1. TechCrunch, Hotel giant Wyndham exposed customer data after app security lapse (November 9, 2026)
  2. CISA, Use Strong Passwords
  3. CISA, Recognize and Report Phishing
  4. Apple Support, What to do before you sell, give away, or trade in your iPhone or iPad
  5. Android Help, Reset your Android device to factory settings
  6. CISA, Turn On Multifactor Authentication
  7. FTC, IdentityTheft.gov: Data breach recovery steps
  8. CISA, Proper Disposal of Electronic Devices

This article is general information, accurate as of November 10, 2026, based on TechCrunch's report and the CISA, Apple, Google and FTC sources listed. Wyndham says it has no evidence of unauthorized access. Details may change if Wyndham publishes more. RedKey is not affiliated with Wyndham.

Back to blog