Industry Brief: Hospitality Cyber Risk Priorities

Why hospitality is different

Hospitality collects sensitive data as a by-product of selling a room. Every reservation, check-in and loyalty sign-up is a data event, and operators often hold passport or ID numbers alongside payment data. In franchised and management-contract models the brand, the owner and the operator each control part of the technology estate, so the question of who is accountable for a given system is not always obvious.

The operating model adds pressure. A hotel cannot pause check-in while IT investigates. Outages are visible to guests within minutes, staffing is often seasonal, and many sites have little local IT. Those conditions favor attackers who ask for access by phone and favor containment decisions that trade one harm for another.

Third parties sit in every flow: property management systems, booking engines, channel managers, payment providers, outsourced IT and call centers. That is analysis, not a measured statistic. The incidents below are consistent with it.

Five priorities at a glance

1. The help desk is part of your perimeter

CISA and the FBI have documented the Scattered Spider group posing as IT or help-desk staff by phone or text message, persuading real help-desk staff to reset passwords or MFA tokens, and so taking over accounts in single sign-on environments. The same advisory describes SIM swapping, repeated MFA push requests until a user accepts, and lookalike domains used to harvest credentials.

A casino operator’s securities filing describes the same weak point from a different angle. It said suspicious activity resulted from a social engineering attack on an outsourced IT support vendor, and that the intruder copied the loyalty program database, which includes driver’s license numbers or Social Security numbers for a significant number of members. The company said it had no evidence that member passwords, bank account details or payment card data were taken. The filing does not name the actor, so the link to the CISA advisory is one of technique, not attribution.

The practical conclusion is that identity recovery is a high-risk process and should be designed like one. Verify callers with information that cannot be found on the internet. Require a second approver for privileged-account and MFA resets. Call back on a number held on file. Apply the same rules to any outsourced help desk, which is a different company with different incentives. And give agents a rule they can follow when the caller is a senior executive in a hurry, because that is the scenario an attacker will stage.

CISA also recommends phishing-resistant MFA, using FIDO/WebAuthn or PKI-based methods, because it withstands push flooding and SIM swaps. Prioritize it for administrators, email and remote access.

2. Guest data: collect less, keep less, know who else holds it

The UK Information Commissioner’s Office fined Marriott International £18.4 million over the Starwood reservation database breach, which involved 339 million guest records. The intrusion began before Marriott acquired Starwood and went undetected for roughly four years. The ICO said Marriott failed to put appropriate measures in place, and the data possibly included unencrypted passport numbers. The fine covered only the period after GDPR took effect, and it was far below the £99.2 million the regulator had first proposed.

Two lessons follow, and both are interpretation. Acquired systems carry acquired intrusions, so due diligence on a hotel group should include a compromise assessment, not only a policy review. And ID data that is no longer needed is liability: decide whether you must keep passport details after check-in, and if you must, encrypt them.

Guests come from everywhere, so notification clocks multiply. Under GDPR a controller must notify the regulator within 72 hours of becoming aware of a breach, where feasible, and a processor must alert the controller without undue delay. Other jurisdictions set their own deadlines. The shortest clock that applies to your guest base should set the plan.

3. Payment environment: shrink the scope

PCI DSS applies to entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment. That includes merchants, processors, acquirers, issuers and service providers. Whether and how an entity validates compliance is set by the payment brands and acquirers, not by the standard’s publisher.

In a group with many properties, scope is the lever. Every place a card is typed, swiped, dipped, stored or read out over the phone brings systems into scope. Tokenization and point-to-point encryption are common ways to take them back out. Ask the uncomfortable questions too: do card details arrive by email, phone or booking-channel messages and land in mailboxes? Does each property run its own terminals, or does the group?

Decide who owns PCI scope at group level, inventory every card-handling path, and treat any path you cannot remove as a candidate for tighter monitoring.

4. Property technology and outsourced IT

Reservation and front-office staff are trusted by design to open emails from booking platforms. Microsoft Threat Intelligence tracked a campaign aimed at hospitality organizations that used fake Booking.com messages and a fake CAPTCHA page. The page told the user to open the Windows Run dialog and paste a command it had copied to the clipboard, a technique known as ClickFix. Payloads included infostealers and remote access trojans such as Lumma, XWorm, VenomRAT, AsyncRAT, Danabot and NetSupport RAT. Microsoft said the aim was financial fraud and theft.

Treat reservation, revenue management and front-office mailboxes as a distinct targeted population. Tailor awareness material to the messages they actually receive. Use endpoint controls that stop a user from running pasted commands. Flag lookalike booking-platform domains at the mail gateway.

Then look at the vendors. List every supplier with standing remote access to production systems, including property-management vendors and managed service providers. Make access time-boxed, logged and protected by strong authentication. Assume one of them will be the weak link, as the outsourced help desk above was, and plan how you would cut that vendor off without taking the property down.

5. A guest service that survives a shutdown

MGM Resorts said in a securities filing that it expected a negative impact of about $100 million from its cyber incident. Press reporting of the company’s statements said that shutting down certain systems to protect data stopped card transactions, took down the company’s websites and its BetMGM app, disrupted digital room access and halted some slot machine play. By that account, the containment decision itself produced much of the visible outage.

That is the point security teams need to take to the executive committee. A precautionary shutdown is a business decision with a price, and the price should be known before the incident. Define the minimum viable guest service for each property: manual check-in from a printed rooming list, a way to issue keys when digital systems are down, an offline method to take and authorize payment, and a way to take orders in food and beverage outlets. Pre-agree who may order a shutdown, and rehearse with general managers, not just IT.

Set the recovery order in advance as well. Identity first, then the property management system, payments, the booking engine and key systems, with the sequence confirmed by the people who run the front desk.

Decisions for leadership

1. Rewrite identity-recovery procedures for in-house and outsourced help desks, with a second approver for privileged-account and MFA resets.

2. Move administrators, email and remote access to phishing-resistant authentication.

3. Cut guest-data retention, encrypt or drop stored ID details, and run a compromise assessment on any acquired estate.

4. Own PCI scope at group level and inventory every card-handling path.

5. Register every vendor with standing access to production, and make that access time-boxed and logged.

6. Define and rehearse the minimum viable guest service, including who may order a precautionary shutdown.

What to track

Five measures show whether these decisions are holding:

• Share of privileged-account and MFA resets that required a second approver.

• Guest ID records held beyond the retention rule.

• Vendors with standing access to production systems, and how many have time-boxed, logged access.

• Properties that have shown they can check in guests and take payment with core systems offline.

• Time to prepare notifications across every jurisdiction in a rehearsal.

Sources

• Scattered Spider joint cybersecurity advisory. CISA and FBI.

• Caesars Entertainment, Inc. Form 8-K. U.S. Securities and Exchange Commission (EDGAR).

• MGM estimates losses at $100 million from cyber incident. Las Vegas Sun.

• UK’s ICO fines Marriott £18.4m for failing to secure customer data. Hospitality Ireland, reporting the Information Commissioner’s Office decision.

• GDPR Article 33: Notification of a personal data breach to the supervisory authority. GDPR text, gdpr-info.eu.

• PCI DSS standard overview. PCI Security Standards Council.

• Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware. Microsoft Security Blog.