Hotel Cybersecurity: Protecting Guest Data and Business Operations

As more and more transactions move online, it’s becoming increasingly important for businesses to protect customer data — and that includes hotels. When it comes to the hospitality industry, the sector is a group that’s among the most at risk for experiencing a cyber attack. Hotels are particularly vulnerable because they often handle a large amount of personal and financial information from guests, especially through online reservations and loyalty programs. Furthermore, studies show that almost one third of all hospitality-based businesses have experienced security or data breaches at some point.

This begs the question: What makes the hospitality industry — and more specifically, hotels — such attractive targets for bad actors? The answer is multifaceted, but boils down to the fact that hotels store a significant amount of sensitive guest data, including millions of credit card numbers, email addresses, birth dates, and contact information.

To help keep this information secure and out of the hands of cyber thieves, it’s crucial for hotels of all sizes to take a proactive approach to cybersecurity by staying informed of the latest threats and putting strict policies in place to counteract them. Read on to find out what these threats are and what you can do to protect your hotel from attacks.

Hotel Cybersecurity Threats to Be Aware of

What You Can Do to Protect Your Hotel from Cybersecurity Threats

All About Hotel Cybersecurity Insurance

Hotel Cybersecurity Threats to Be Aware of

In order to mount the best defense against cyber attacks, it’s important for hotels to have a thorough understanding of the kinds of threats they could face. These are some of the most common types that hotels currently deal with:

DarkHotel Hacking

A form of spear phishing, in which specific targets are selected by hackers, DarkHotel hacks involve using a hotel’s WiFi network to gain access to the devices of prominent guests — typically high-ranking government officials or senior business executives. The end goal of these types of attacks is to capture sensitive corporate information.

Data Breaches

This type of cyber attack is one of the most common and occurs when malicious actors gain access to a hotel’s (or any other type of business’) systems to steal sensitive customer data. Once exposed, this data can be used for fraudulent purposes — putting affected customers at risk of identity theft.

Distributed Denial of Service Attacks

Distributed denial of service (DDoS) attacks are used to shut down individual services that hotels rely on for operation, including (but not limited to) security systems, key card creation and room entry, and even entire computer networks. Cyber criminals often rely on this type of attack to keep businesses distracted while they carry out more sinister breaches.

Malware & Ransomware

Malware attacks involve the perpetrator installing harmful software on a victim’s computer that then enables them to collect sensitive information, interfere with internal systems, or restrict the victim’s access to certain data or programs. Ransomware takes this idea one step further by making it possible for cyber thieves to demand hefty ransoms by holding their victims’ computer systems hostage or threatening to make sensitive information public.

Phishing Attacks

Phishing is one of the oldest tricks in an e-criminal’s book. This cyber attack method is carried out by sending messages that contain harmful links in an email (or occasionally a text message) that’s disguised as one from a legitimate source. The intent is to trick recipients into sharing information such as passwords, banking details, or social security numbers.

Point of Sale Attacks

While many cyber thieves choose to target a hotel’s stored data, others opt to steal information via a different avenue — the point of sale (PoS). PoS systems are used where all physical transactions take place, like at the front desk or at a gift shop register. In order to gain access to the PoS, hackers introduce malware to the system that enables them to steal credit and debit card information such as cardholder names and addresses, card numbers, PINs, and security codes.

What You Can Do to Protect Your Hotel from Cybersecurity Threats

The consequences of a cyber attack are expensive and far-reaching. For example, if a hotel is the victim of a cyberattack, it may need to notify affected customers and bear the cost of repairing damages from the cyber event and any reputational harm. Luckily, there are steps you can take to protect your hotel from these cyber threats. Some effective techniques include:

• Taking preventative action. In the fight against cyber crime, it’s always better to be proactive instead of reactive — especially with your guests’ personal data at stake. Training staff on how to recognize fraud attempts, keeping systems updated and patched, conducting regular risk assessments, following data center security best practices, restricting permissions, implementing firewalls and end-to-end encryption, and investing in antivirus software all play a part in keeping your guests’ data and hotel’s systems secure.

• Putting a contingency plan in place. When a data breach or any other cybersecurity incidents occur, taking action quickly can significantly reduce the scale of impact. By establishing a response protocol before breaches occur, you’ll be prepared to act swiftly when needed.

• Taking out a cyber liability or data breach insurance policy. As instances of cybercrime continue to increase, the chances of your hotel being a target also rises. That’s why it’s important for hotels to protect themselves from the financial and reputational fallout that can occur in the wake of a breach.

All About Hotel Cybersecurity Insurance

If your hotel doesn’t carry a cybersecurity insurance policy, you’re not alone — a 2022 survey from BlackBerry reveals that only 55% of businesses do. And with the average cost of a data breach climbing to $4.45 million in 2023, the potential risks are too great to remain unprotected.

Coverages & Claims

When it comes to coverages, individual policies vary based on a number of factors, mainly whether your policy includes first-party or third-party liability coverage. In general, first-party coverage covers costs related to data recovery and replacement; income loss; legal counsel; and any fees, fines, or penalties incurred due to a cyber incident. If your plan includes third-party liability coverage, you’ll also be protected from paying legal fees, lawsuit settlements, consumer payments as well as losses that result from defamation infringement. Other coverages include:

• Extortion and fraudulent instruction
• Endorsements for invoice manipulation, cryptojacking, bricking, and voluntary shutdown

Some policies may offer prevention and response services, or pre-breach response services, which emphasize the importance of employee training in cybersecurity practices to mitigate losses.

The following are some of the cybersecurity claims most frequently submitted:

• Stolen funds — This occurs when cybercriminals steal money electronically, often through social engineering tactics like CEO scams or wire transfer fraud.
• Stolen data — Hackers target valuable data stored on computer networks, such as personal information of customers or clients, and may demand a ransom.

• Damaged digital assets — This involves ransomware attacks where cybercriminals encrypt a company’s IT systems and demand payment to release the data. Even after paying the ransom, businesses often face damaged systems that are costly to repair.

Exclusions

Not every event related to cybersecurity will be covered as part of a policy, which is why it’s important to thoroughly understand the specific terms and limitations of your cybersecurity insurance policy.

Some of the events you shouldn’t expect your hotel cybersecurity policy to cover include bodily injury or property damages, property loss, damages resulting from criminal or intentionally dishonest acts, or losses that occur as a result of suboptimal cybersecurity practices. Additional exclusions may apply, such as:

• Retroactive date — Cyber policies often include a retroactive date, meaning incidents that occurred before this date are not covered. If a cyber event is discovered after the policy begins but occurred before the retroactive date, it won’t be covered.
• Critical national infrastructure failure — Failures or outages in critical national infrastructure, such as satellite failures or electrical disturbances, are usually not covered under cyber policies.

• Jurisdictional limitations — The geographical scope of the policy is important. Losses occurring outside the specified coverage territory may not be covered. This is especially relevant for international incidents or businesses with a global presence.

Protect Your Hotel with C&S Insurance

As instances of data breaches and other cyber attacks against hotels continue to rise, it’s crucial for hospitality industry businesses to take a proactive approach to cybersecurity. Of all the preparedness measures to take, getting a cybersecurity insurance policy for your hotel should be at the top of your list, as a breach could otherwise cost you hundreds of thousands (or even millions) of dollars.

If you’re considering a cybersecurity policy for your hotel, or any other type of business, our team of insurance experts can help answer all your questions. Contact us today to start the conversation about your options.

Or, for more information about different types of business insurance download a free copy of our Business Insurance eBook.