[Single source] Hardcoded credential in Wyndham app exposed customer data

TechCrunch reports exclusively that hotel giant Wyndham left a hardcoded credential in its customer app, and that the lapse allowed anyone to access customer data. The company would not say whether it has the ability to check for any past unauthorized access to that data.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

On November 9, 2026, TechCrunch published an exclusive report revealing that Wyndham, described by the outlet as a hotel giant, suffered a security lapse involving a hardcoded credential left in its customer app.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

According to the report, the hardcoded credential allowed anyone to access customer data. When asked, Wyndham would not say whether it has the ability to determine if any unauthorized access occurred in the past.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

A credential that is hardcoded into a shipped app can potentially be found by anyone who examines the app, and in this case TechCrunch reports it opened the door to customer data. That suggests the exposure window may have lasted for as long as the credential remained embedded in the app.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

Because Wyndham would not confirm whether it can audit for past unauthorized access, affected customers may have no way to learn whether their data was ever viewed by unauthorized parties. That unanswered question is central to judging the real-world impact of the lapse.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

The report contains no instructions, guidance, or notifications from Wyndham to its customers. In the absence of specific direction from the company, customers of the Wyndham app are left waiting to see whether the hotel giant issues a disclosure, a fix confirmation, or an affected-user notification.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

What is established by the reporting: a hardcoded credential was left in Wyndham's customer app, the credential allowed anyone to access customer data, and Wyndham declined to say whether it can check for past unauthorized access.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

What remains unknown: the type of customer data involved, how long the credential was embedded in the app, how many customers or records are affected, whether the lapse has been remediated, who discovered it, and whether any unauthorized access actually took place. The article does not address any of these points.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

The most consequential open question is historical: as TechCrunch notes, Wyndham wouldn't say if it has the ability to check for any past unauthorized access, leaving the possibility that past misuse is undetectable.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

The evidence batch contains no third-party commentary, expert analysis, or regulator statements. The only actors on record are TechCrunch, which reported the exclusive, and Wyndham, which reportedly would not say whether it can check for past unauthorized access to the exposed customer data.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

The story entered the public record as a single TechCrunch exclusive published on November 9, 2026. No follow-up coverage, company statements, regulatory responses, or corrections appear in the current evidence batch, so the narrative has not yet evolved beyond the initial disclosure.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

1 independent groups, 1 updates, and 0 engagements.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

The technical failure, per TechCrunch, is a hardcoded credential left in Wyndham's customer app that allowed anyone to access customer data. The report does not specify the credential's type, the backend system or API it unlocked, or how the lapse was discovered.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

As a general matter, hardcoding a credential means embedding an authentication secret directly in an application's shipped code instead of keeping it secured server-side, which makes it recoverable by anyone who inspects the app. This background explains why such a lapse is treated as a serious finding, though the article itself does not elaborate on the mechanism.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list

This brief rests on a single source: TechCrunch's exclusive article 'Hotel giant Wyndham exposed customer data after app security lapse', published November 9, 2026 and ingested via RSS as the primary source for the story. Every claim in this brief traces back to that one article; no independent corroboration, company filing, or additional outlet is present in the evidence batch.[1]Hotel giant Wyndham exposed customer data after app security lapsetechcrunch.com · rssOpen original sourceSee in source list