Wyndham's Exposed Customer Data Leaves a Question the Company Won't Answer

Two things happened here, and they point in opposite directions. Wyndham found the flaw — a credential left sitting in its own code — which means someone did the real work of discovery and repair. And yet, when asked a plainly answerable question, whether it could look backward to see if anyone walked through that open door, the company declined to say. The repair is visible. The candor is not.

That gap deserves more attention than the lapse itself. A fixed vulnerability and an honest account of a vulnerability are not the same virtue, and the second is harder than the first. Repair is technical work with a clear finish line; honesty is a continuing posture that requires letting other people know what was done to them. Customers who trusted the Wyndham app with their information cannot know whether that trust was broken, because the one question that would tell them has been left unanswered. Scripture keeps drawing this line in its own way — the recurring call is not simply to correct our errors but to walk in the light, because a wrong that stays hidden keeps its weight on everyone it touched, including the one hiding it.

A fair limit: declining to comment is not proof of concealment. Companies often restrict statements while investigations continue, and nothing in this report establishes that anyone's data was actually misused. Silence can be caution as easily as cover. But the limit cuts the other way too — restraint in speaking is no substitute for eventually speaking.

Most of us will never manage a hotel empire's security systems, but we know the smaller version of this temptation well: quietly patch what we broke, move quickly to the fix, and hope no one asks what happened while the door stood open. The harder and better question comes before the repair begins — am I more interested in making this problem disappear, or in letting the people it affects know the truth?