The Wyndham Data Breach Started With A Password Hidden In An App

November 11, 2026 · 7 min read

A father books a Super 8 in Toledo for his daughter’s volleyball weekend and pays with points. Three weeks later an email arrives. It greets him by name, quotes his Wyndham Rewards member number, and says his reservation needs re-confirming. The number is correct, so he taps the link. The Wyndham data breach is how his name, his email address and that member number ended up in the same row of somebody else’s spreadsheet.

Confirmation: acknowledged by Wyndham in a statement to TechCrunch on November 9, 2026, after a researcher reported it. Wyndham says it has no evidence of unauthorized access.

What happened in the Wyndham data breach

Security researcher Robert Wiggins of What Security took apart Wyndham’s Android app and found a password sitting in its source code. TechCrunch reported the finding on November 9, 2026. That password opened an internal Wyndham database hosted by Salesforce.

Developers call this hardcoding, and it is treated as a serious fault for a simple reason. Anyone who downloads a public app can pull the app apart and read the strings inside it. So a password shipped in an app is a password handed to every person who installs it. Many such findings get the maximum severity rating because of that.

Wiggins asked TechCrunch for help reaching the company, because Wyndham has no published route for reporting security flaws. Soon after TechCrunch contacted Wyndham’s security staff, the credential was revoked. That closed the door. It does not say who walked through it first.

What was exposed, and what someone can do with each item

Wiggins reported four kinds of data in the database, plus Wyndham’s own files and documents.

Your name. On its own it is harmless. Beside the next two items it makes a scam letter sound like a real one.
Your email address. This is the delivery route for everything that follows, and you cannot change it as easily as a password.
Your Wyndham Rewards member number. This is the detail that does the damage. A stranger quoting your member number sounds like the hotel, because who else would have it?
Login tokens, called JWTs. These are the credentials that keep you signed in without retyping a password. Hold a live one and you can act as the account holder.

That last item is why this story sits in the account-security pile rather than the mailing-list pile. A password you can change tonight. A session token is issued by the company, and you have to make the company retire it.

What Wyndham has not said

The size of the Wyndham data breach is still an open question. The database held millions of entries, but Wiggins could not establish how many customer records that came to. Wyndham has not published a number either. For scale, the company advertises around 129 million enrolled rewards members, though that is enrollment rather than exposure.

Wyndham declined to answer several questions, and each gap matters:

Whether it holds server logs that would show earlier access to the database.
How long the password had been embedded in the app.
Whether it plans to notify affected customers.
Whether it will disclose the incident to U.S. regulators, such as the SEC.
Whether it will set up a disclosure program so researchers can report flaws privately.

So read “no evidence of any unauthorized access” carefully. Without logs, that sentence can describe a clean system or an unlit one, and from the outside the two look identical. Wiggins made the same point: with no view of past activity, someone could have taken large amounts of customer information quietly.

This is the second one in two weeks

Wiggins found a near-identical flaw in the Applebee’s app two weeks earlier, which also exposed customer data. He used AI tooling for both, and that is the part worth noticing. Decompiling an app and scanning thousands of lines for a stray credential used to be an afternoon’s work. Now it takes seconds, so the cost of looking has collapsed for researchers and for everyone else.

Wyndham also has history here. In 2024, a researcher found remote-access spyware running on Wyndham hotel check-in desks, leaking screenshots of guest records to the open web.

What to do after the Wyndham data breach

Most of this has nothing to do with OptMsg.

Change your Wyndham Rewards password and sign out on every device. That is how most apps retire old session tokens, which is the part a password change alone does not fix.
Turn on the strongest sign-in Wyndham offers you, then do the same on the card you book with.
Open your points balance and your recent stays, and read them. Loyalty points are spendable, so they get stolen like money. Report anything you did not book.
Treat any email quoting your member number as unverified for now. Open the Wyndham app yourself, or type the address in, rather than tapping a link in the message.
Use a password manager, because a password reused from a breached site is what turns one leak into five.
Give each brand its own email address if your provider supports aliases. Then the next vendor leak is traceable, because one address receives the fraud and the rest stay quiet.

How OptMsg changes this exposure

At its real size, honestly: OptMsg could not have stopped the Wyndham data breach. The password was in Wyndham’s app, on Wyndham’s database, holding a list Wyndham built. Nothing about an inbox reaches into that.

What it changes is the half that arrives at you. Two mechanisms do real work.

Your OptMsg account has no password, because passwords do not exist on it. Passkeys are the primary way in. So a password leaked from another site cannot be tried against your inbox, since there is nothing on the account for it to match. Your inbox is the reset route into most of your other accounts, so holding that door shut holds more than one.

And mail from a sender you have not approved goes to Trash rather than your Inbox, where it auto-deletes after 30 days. The follow-up phish in a case like this one lands there instead of in the stack you actually read.

Here is the limit, plainly stated. A message sent through a brand you did approve can still reach your Inbox, so judgment stays part of the job. An opt-in inbox also does nothing about a compromised device, a live phishing page you type your details into, or an unlocked phone in someone else’s hand. The argument covers the mail, and not the rest of it. You can read the longer version on our security-first page.

Want an inbox where you decide who gets through? Create an OptMsg account and approve your first sender in about a minute.

Create Your Account

Frequently asked questions

Was my Wyndham password stolen? No account password was reported as exposed. The database held names, email addresses, Wyndham Rewards member numbers and login tokens, plus company files. Those tokens matter anyway, because they can keep a session signed in without a password, so changing your password and signing out everywhere is still the right move.

How many people were affected by the Wyndham data breach? Nobody has published a figure. The researcher said the database held millions of entries but could not determine an accurate record count, and Wyndham has not given one. The company advertises about 129 million enrolled rewards members, which measures enrollment rather than exposure.

Will Wyndham tell me if my data was in it? Unclear. Wyndham would not say whether it plans to notify customers, or whether it will file notice with U.S. regulators. So do not wait for a letter before you change your password.

Is my Wyndham Rewards points balance at risk? Check it. Points are spendable, which makes them a target, and a leaked session token is a plausible route into an account. Read your recent stays and redemptions, then report anything you did not do.

Someone emailed me about this breach. Is it real? Treat it as unproven. Forged breach notices follow real ones quickly, because urgency sells and the topic is in the news. Open the company’s app or type its address yourself, then look for the notice there.

Sources

TechCrunch, “Hotel giant Wyndham exposed customer data after app security lapse,” Zack Whittaker, November 9, 2026 — https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/
TechCrunch, “Applebee’s exposed customers’ personal data after leaving database password in app,” October 30, 2026 — https://techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/
Wyndham Hotels & Rewards, corporate site — https://www.wyndhamhotels.com/