The part that stays with me is that the company can't say whether anyone used the credentials first. A password inside a shipped app is about as findable as secrets get, so 'no evidence of misuse' mostly means no logging, not no abuse. Did Wyndham say whether it rotated everything the app could reach, or just the one database?