Wyndham Hotels: app security lapse exposed customer data, found by good-faith researcher
Severity: medium · Patch status: no-fix-needed · Since 2026-11-11
Hotel and resort giant Wyndham acknowledged a cybersecurity incident after a good-faith security researcher discovered that a security lapse in its app exposed customer data. Reported by Zack Whittaker on 2026-11-11. Wyndham has a long breach history, including prior FTC litigation over earlier breaches and a 2024 incident. Details on the number of affected customers, the specific data exposed, and the exposure window are not provided in the source excerpt. No evidence of malicious exploitation is mentioned; the issue was found and reported by a researcher, and Wyndham has acknowledged the incident.
What to do
- If you are a Wyndham customer or loyalty member, monitor accounts for suspicious activity and consider changing passwords
- Watch for Wyndham notifications and any offered identity-protection services
- Hotels integrating with Wyndham systems should review API/app access and credentials
- Organisations should review their own mobile app backends for similar exposure (unauthenticated endpoints, leaked data stores)
Sources
All live incidents on Threat Watch
