INDUSTRY FACT FILE · HOSPITALITY, TRAVEL & TOURISM

Threat Landscape: Top Cyber Threats Facing Hospitality, Travel and Tourism

The 18 most relevant cyber threats, attacks and industry challenges for hotel chains and owners, travel platforms, tour operators, restaurants and venues, and the impact each one has on guests, operations, revenue and brands.

Hospitality and travel companies attract criminals because they hold passports, cards and travel plans for millions of guests; because operations stop visibly when systems fail; because loyalty points are a liquid currency; and because guests trust messages that appear to come from their hotel or booking platform. The attack surface spans booking engines and apps, OTA extranets, vendor-run PMS and channel managers, payment gateways and PoS, guest and conference Wi-Fi, loyalty platforms and thousands of staff accounts across properties.

Landmark incidents show the pattern. Marriott's Starwood database was accessed from 2014 until discovery in 2018, exposing about 339 million records and drawing an £18.4 million ICO fine and a US$52 million settlement. Sabre's SynXis platform (2017) leaked card data for hotels worldwide. Scattered Spider (2023) disabled MGM's keys and reservations and stole Caesars' loyalty database. Omni Hotels (2024) lost systems for days to a Daixin attack. Otelier (2024-25) exposed reservation data for major brands after stolen credentials opened its cloud storage. Phishing through Booking.com extranets now targets guests directly. In India, Cleartrip confirmed an internal systems incident in 2022 and Taj Hotels investigated a claimed 1.5 million-record leak in 2023.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by hospitality and travel segment (Codec Networks assessment).

4.1 Guest data and the vendor chain

Marriott, Sabre and Otelier show that guest data leaks through central reservation systems and vendors as often as through the hotel itself. Passports scanned at check-in and card tokens travel across brands, owners and platforms.

• Questions to test: Where is every passport and card we hold? Which vendors hold guest data and under what contract? Is identity data minimised and retained only as long as needed? Can we notify under DPDP?
• Relevant services: DPDP programme, data mapping, vendor assurance, breach readiness.

4.2 OTA extranets and guest-facing fraud

Criminals phish hotel staff for extranet credentials, then message upcoming guests through the platform demanding 'payment verification' on look-alike sites. Booking.com has said its systems were not breached—the weakness is at the hotel.

• Questions to test: Do all extranet and channel manager accounts have MFA? Are logins and guest messages monitored? Can reservations staff recognise OTA-themed phishing? How fast can we take down a fake payment site?
• Relevant services: extranet account review, phishing simulation, monitoring, brand monitoring and takedown.

4.3 Ransomware and the property that runs on paper

MGM and Omni show that when PMS interfaces, PoS and key systems stop, guests queue and bookings leak to competitors. Backups on the same network turn hours into weeks.

• Questions to test: Are PMS, PoS, key and building networks separated from office IT? Are backups immutable and restores tested? Are EDR alerts watched 24x7? Is there a manual check-in and billing playbook?
• Relevant services: segmentation, backup and recovery testing, SOC, continuity playbooks.

4.4 Guest networks, executives and events

Business hotels and venues concentrate corporate devices on shared networks for days at a time; weak segmentation exposes both guests and property systems.

• Questions to test: Is guest Wi-Fi segmented with client isolation? Are captive portals and controllers hardened? Are property systems reachable from guest networks? Do we test before major events?
• Relevant services: wireless penetration testing, segmentation review, event security monitoring.

4.5 Detection, reporting and the 6-hour clock

CERT-In requires reporting within six hours; DPDP breach intimation follows from 2027; card schemes, OTAs and brands expect prompt notice. Properties and vendors are usually unmonitored.

• Questions to test: Are properties, platforms and extranets monitored 24x7? Do we see vendor access? Is there a playbook combining containment, CERT-In reporting, guest communication and brand and OTA notification?
• Relevant services: SOC, playbooks, joint drills with properties and vendors.

• CERT-In: incidents reported within six hours of noticing them.
• DPDP: breach intimation to the Data Protection Board and affected guests from May 2027.
• RBI, acquirers and card schemes: payment incidents engage tokenisation rules, PCI DSS obligations and scheme penalties.
• Bureau of Immigration: compromised identity data collected for Form C raises reporting and handling questions.
• SEBI LODR: listed companies disclose cyber incidents quarterly.
• Brands, owners, OTAs and corporate clients: contractual notification, audit and remediation obligations.

• Where is every passport and card we have collected, and which vendors hold them?
• Do all our OTA, channel manager and loyalty accounts enforce MFA and get monitored?
• Would our booking engine and app survive a bot attack at peak season?
• Is our guest and conference Wi-Fi segmented and tested before major events?
• If the PMS and PoS went dark, could we check guests in and bill them safely?
• Could we detect, contain and report an incident within six hours while telling guests the truth?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events, regulator decisions and company statements.