Hospitality’s growing cybersecurity threat: Why protecting guest data is everyone’s responsibility

Recently, the accommodation industry has experienced a worrying increase in cybersecurity incidents. Globally, several hospitality technology providers have reported unauthorised access, system disruptions and exposure of guest information.

The timing and similarities among these incidents raise concerns that the industry may be deliberately targeted. Although connections have not been confirmed, it is becoming evident that hospitality is an attractive target for cybercriminals, and the risks extend far beyond any individual technology platform.

For accommodation operators, the challenge is no longer solely about securing their property management systems (PMS). They must also understand where their guest information is sent, who has access to it and how many different platforms are involved in processing a single booking.

First published in the November edition of Resort News. Read it HERE

The rise of convincing guest scams

One of the most concerning trends is the increasing sophistication of fraudulent messages being sent to guests.

We’re seeing reports of guests receiving WhatsApp messages, emails and text messages containing legitimate reservation details, including property names, travel dates and booking references.

The messages often claim there’s a problem with the booking or that payment details need to be verified to prevent cancellation. They then direct guests to fraudulent websites designed to resemble legitimate booking platforms.

A message referencing an upcoming stay, the correct accommodation provider and genuine reservation details is far more convincing than a generic phishing email. Unfortunately, the presence of legitimate booking information doesn’t necessarily tell us where that information was obtained.

A booking passes through more systems than you think

Consider the journey of a typical accommodation reservation. A guest books through an online travel agency. Their information is transmitted through a channel manager into a PMS. From there, it may be shared with guest communication platforms, digital check-in providers, revenue management systems, payment services and other applications.

Increasingly, AI tools are also being connected to these systems. Each integration serves a purpose, and collectively they make accommodation businesses more efficient. However, every additional platform that processes guest information introduces another potential point of exposure.

Even when an accommodation operator’s primary systems are secure, a vulnerability or compromised credential at an external provider could expose information accessed through that connection.

Could the information be coming from the guest?

There’s another possibility that’s often overlooked. Sometimes, the source of a fraudulent booking message may be the guest’s own email account.

Stolen email credentials are a widespread cybersecurity problem. Phishing, malicious software or reused passwords across multiple websites can compromise individual email accounts.

If a threat actor gains access to someone’s inbox, a booking confirmation may contain everything needed to create a convincing scam: the accommodation provider, travel dates, reservation reference and contact information.

The threat actor doesn’t necessarily need access to a hotel system or booking platform. This is why we need to be careful about automatically attributing every fraudulent guest message to a breach of an accommodation provider’s technology. Accurate reservation information is a reason to investigate, not proof of where a compromise occurred.

Read more in AccomNews HERE: The new hotel arrival: Smarter check-in, digital keys and self-service

AI is creating a new security challenge

Artificial intelligence is rapidly changing how accommodation businesses operate. From automated guest communications to revenue management and operational workflows, AI has enormous potential to improve productivity and guest experiences.

However, the increasing use of AI agents and applications connected through application programming interfaces (APIs) introduces another layer of risk. Some operators connect external AI tools directly to their systems, giving them access to reservation information, guest contact details and operational data.

The question operators need to ask is simple: Do you know exactly what information your AI tools can access, where it’s stored and who is responsible for protecting it? An AI application doesn’t need unrestricted access to every guest record to perform a relatively simple task.

As an industry, we need to become much more disciplined about limiting access to the information genuinely required, reviewing API permissions and removing connections that are no longer needed.

Innovation and security must develop together.

What accommodation operators should be doing

The recent incidents should serve as a timely reminder to review cybersecurity practices across the entire business.

Start by auditing the third-party applications connected to your accommodation systems. Understand what each application does, what information it can access and whether you still need it.

Review API credentials and access permissions, especially for applications connected for several years without reassessment.

Enable multi-factor authentication wherever possible, including for email accounts, booking channel extranets and other critical business systems.

Educate staff about phishing attempts and unusual payment requests, and consider proactively warning guests about fraudulent messages.

Most importantly, establish a clear process for reporting suspicious activity. The sooner unusual behaviour is identified, the sooner it can be investigated.

Security is a shared responsibility

Hospitality has become an incredibly connected industry. That’s one of our greatest strengths, but it also means cybersecurity can no longer be viewed as the responsibility of a single software provider.

Technology companies must secure their own infrastructure, monitor for suspicious activity and implement appropriate controls around the access they provide. They must also be transparent when incidents occur. But no individual provider has complete visibility into or control over the internal security of every independent platform connected to its systems.

Accommodation operators also have a responsibility to understand the technology they use, manage access appropriately and educate their teams and guests.

Guests need to stay cautious about unexpected communications, particularly those requesting payment information.

The recent wave of incidents is concerning, but it also presents an opportunity for our industry to improve how we approach cybersecurity. We shouldn’t respond by becoming fearful of technology or avoiding innovation.

Instead, we need to better understand how our systems interact, be more disciplined about data access and be more proactive in protecting the information entrusted to us.

So, the next time your technology provider introduces additional security measures or asks you to update your credentials, don’t resist it. It might add an extra step to your day, but it’s a small price to pay for protecting your business and your guests.

Security isn’t one person’s responsibility. It’s everyone’s.