Hotel hackers, what are the causes and effects of a cyberattack on a hotel?

Hotels are very convenient and hospitable places for hackers - and not just literally. The level of security in some of them is nowhere near the hacking skills. As a result, valuable and detailed guest data is often served on a silver platter. What is the level of cybersecurity in hotels? Is it easy to steal hotel guest data? Why do cybercriminals eagerly attack hotels? What are the consequences of a cyberattack on a hotel? You will find out from our article.

The hotel industry is a popular target for hacking attacks.

Every day, a multitude of travelers pass through hotels - whether they are on private vacations, business trips or attending conferences. Many guests means: a lot of valuable, diverse, and detailed information, including personal and contact data, credit card numbers, payment-related information, and length of stay. Additionally, if a hotel offers spa services, health information of guests also becomes part of a sizable database. It's no wonder that the game is worth the candle for cybercriminals.

Hackers are also attracted by the ease with which a cyberattack can be carried out. Many hotels have open Wi-Fi networks. Other use passwords for both their own resources and networks available to guests, but these access credentials can be easy to guess. For example, in 2022, hackers "for fun" breached the Holiday Inn network using the weak password "Qwerty1234" and deleted a significant portion of data. The Wi-Fi password can also be easily stolen by someone from outside, especially if the staff leaves it on a note at the reception. Hotel guests, without much knowledge of cybersecurity, casually connect to the hotel's Wi-Fi network using laptops (including work devices containing valuable company data) and smartphones. Hackers just need to sit comfortably and effortlessly intercept a range of information.

Paradoxically, the digitization and technological advancement have weakened the cybersecurity of hotels. Of course, we absolutely do not want to demonize technological development. It makes work in hotel establishments more efficient and customer needs are met more effectively and quickly. For example, using a mobile app to book a room or implementing smart solutions for the entire facility greatly facilitates operations. However, the more complex the IT systems are, the more opportunities for hackers to breach them. It's worth mentioning the case of the Austrian hotel Seehotel Jägerwirt, which fell victim to a cyberattack in 2017. Hackers gained access to the hotel systems using phishing techniques. They then launched ransomware software, completely blocking the IT system. This not only prevented check-ins and check-outs but also rendered the room locks inoperative. The hotel, located in the Alps and fully booked, decided to pay the ransom to restore normal operations as quickly as possible.

What are the consequences of a cyberattack on a hotel?

An effective attack usually results in the compromise of both - guest and employee data leak. Cybercriminals can successfully sell this data on the dark web. In 2018, the Starwood network, which belongs to Marriott and comprises 6,700 hotels worldwide, suffered a major data breach, exposing sensitive information of a vast number of customers. It is estimated that up to 500 million people who stayed at the hotels between 2014 and 2018 were affected. Marriott seems to have been particularly unlucky with such attacks. In 2020, there was another data breach affecting 5.2 million individuals, and in 2022, hackers stole 20 GB of data on guests and employees.

One of the classic moves by "hotel hackers" is a ransomware attack, followed by coercing the victim to pay a ransom in exchange for unlocking access to data or preventing the disclosure of that data on the black market. We mentioned this earlier when describing the case of Seehotel Jägerwirt. In 2022, Starwood was also targeted with a ransom demand, but the network chose not to give in to the demands.

The costs of inadequate security are very high.

Attacked hotels face many more financial problems than just the possibility of paying a ransom. This includes compensation for affected customers. In the case of the Marriott breach in 2018, hotel guests filed a class-action lawsuit seeking a total of $12.5 billion. This amounts to $25 per person whose data was compromised by the hackers.

As one can imagine, such troubles lead to further consequences. The Starwood network dealt with significant reputational damage, resulting in reduced revenue and a roughly 5% decline in share value on the U.S. stock exchange.

In today's world, any company, whether it's a small hotel or a hotel giant operating with a huge budget, can become a victim to a hacking attack regardless of their level of cybersecurity. It is worth implementing appropriate procedures in hotels that, even if they don't prevent an incident, significantly minimize the negative consequences.

How can you check if a hotel's IT infrastructure is sufficiently resistant to cyberattacks? Conduct a free cybersecurity audit that will identify vulnerabilities and provide guidance on how to eliminate them. Additionally, regularly visit our blog, fanpage, or LinkedIn profile where we share valuable information on cybersecurity.

See you!