Wyndham revokes app credential that exposed customer data

Wyndham revoked a password embedded in its Android app after security researcher Robert Wiggins found it could unlock an internal Salesforce-hosted database, TechCrunch reported. Wiggins said the database exposed customer names, email addresses, membership numbers and login tokens that keep users signed into their apps. The database contained millions of entries, but Wiggins could not determine the number of exposed customer records. Wyndham said it had no evidence of unauthorized access. The company declined to say whether it had logs or other technical means to establish whether anyone accessed the database before the discovery.