Hotel cybersecurity: a guide for managers in Brazil

Hotels handle personal and payment data in almost every interaction with a guest, run critical systems without interruption and depend on many technology suppliers with access to their network. That makes the sector an attractive target, as high-profile cases involving chains such as Marriott and MGM Resorts show.

This guide is the starting point. The sector figures, with sources, are in the 2026 hotel cybersecurity risk report; the real cases of hotel chains that were attacked are in the article on hotel cybersecurity risks.

Why hotels are targets

Three characteristics put hospitality in the line of fire:

• Concentrated data: identity documents, card data, stay history and preferences for thousands of guests, gathered in the PMS and the systems connected to it.
• An operation that cannot stop: a hotel without its PMS loses bookings, check-ins and charges every hour. That pressure is what ransomware exploits to extract the ransom.
• Many people and many suppliers: front desk turnover, contractors with remote access and many integrated systems, each with its own passwords and updates.

A hotel's attack surface

The attack surface of a hotel is much larger than it looks. The main vectors include:

PMS systems: The Property Management System is the heart of the operation. A breach in it can expose guest data, payment history, corporate contracts and, depending on the payment architecture, card data or tokens. Many PMS installations in Brazil still run on outdated versions or on infrastructure without adequate network segmentation.

Guest Wi-Fi networks: When the guest network is not isolated from the hotel's operational network, an attacker who gets onto the lobby Wi-Fi can reach internal systems. It is a recurring problem. See how to protect the network in the guide to guest Wi-Fi security.

Payment terminals: Badly configured POS terminals or ones with outdated software are vectors for card data theft. The hotel sector is frequently the target of attacks aimed specifically at these points.

Suppliers with remote access: Systems integrators, video-on-demand suppliers, booking system providers: many have remote access to the hotel's infrastructure. Without control over who accesses what and when, every supplier is a potential way in. The guide to IT supplier management shows what to require in the contract.

Email and online accounts: Business email compromise (BEC) attacks are common in hospitality, especially targeting bank transfer requests or changes to supplier details. The accounts payable team is a frequent target, as are the hotel's accounts on the OTAs. AI has made these scams more convincing, as we show in AI scams against hotels.

Locks, cameras and automation: Electronic locks, cameras, TVs and building automation tend to receive few updates and often sit on the same network as the administrative systems, which turns them into an entry point or a target for an attack that spreads across the network.

What changes in Brazil

The vectors above apply to any hotel in the world. Four topics are specific to operating in Brazil:

Pix: Fake or altered payment receipts, fraudulent charges via WhatsApp and fake profiles in the hotel's name. Because Pix (Brazil's instant payment system) is instant and hard to reverse, the protection lies in the process, such as confirming the credit on the bank statement before releasing the booking. The main scams are covered in Pix scams and booking fraud.

LGPD: An incident involving personal data that may cause significant risk or harm must be reported to the ANPD (Brazil's data protection authority) and to the affected guests within 3 working days (ANPD Resolution CD/ANPD No. 15/2024, in Portuguese). Without a plan ready, the deadline passes before the hotel understands what has happened. See what the LGPD (Brazil's data protection law) requires of hotels and what to do in the first 48 hours of a data breach.

Digital FNRH: Since 20 April 2026, the FNRH (Ficha Nacional de Registro de Hóspedes, Brazil's national guest registration form) is submitted exclusively through the digital FNRH platform, usually through integration with the PMS. It is one more integration carrying guests' personal data: it is worth knowing who holds the access credentials and what the PMS sends.

PCI DSS: Every hotel that accepts cards is in scope for PCI DSS, required by the card brands through the acquirer. The version in force is 4.0.1, and network segmentation is what reduces the scope most. Details are in the guide to PCI DSS for hotels.

Ransomware in hospitality

Ransomware is one of the most disruptive threats to the hotel sector. A successful attack can lock the hotel out of the PMS in the middle of a high-occupancy weekend, force it to process check-ins and payments by hand and, in serious cases, cut off access to the electronic locks.

Attacks do not usually start with the PMS. They come in through a phishing email aimed at a member of staff, through a VPN without multi-factor authentication, or through a supplier with poorly controlled remote access. From there, the ransomware moves laterally across the network until it reaches the critical systems.

The guide on how to protect a hotel against ransomware sets out the controls that reduce the risk most, what to do in the first hours and how to recover the operation without reinfecting the network.

Where to start

In general, a hotel does not need a complete security transformation straight away. It needs to close the most critical gaps first.

Inventory of assets and access: Do you know which devices are on your network? Who has remote access to the PMS? Which supplier can connect to your lock system? Without this map, any security effort is incomplete.

Network segmentation: The guest network should be completely separate from the operational network. This limits the reach of an attacker who compromises the lobby Wi-Fi.

Multi-factor authentication (MFA): For corporate email, the VPN and any system with remote access. It is one of the most cost-effective measures available.

Vulnerability and patch management: Updates applied on a defined schedule, and a list of the systems that cannot be updated, with the reason and the compensating control adopted for each exception, such as network isolation or restricted access. See how to handle these cases in the guide to legacy systems and unsupported Windows.

Isolated, tested backups: A copy outside the main network, with restores that have actually been tested. It is one of the factors that weighs most on how quickly the hotel is back in operation after ransomware.

Supplier assessment: Review which suppliers have access to your network, how often and through which mechanisms. Contracts should include minimum security requirements.

Incident response plan: When an attack happens, does the team know what to do? Who to call? Which systems to isolate? Without this plan, the response will be chaotic.

To find out where your hotel stands today, use the hotel cybersecurity checklist or take the online assessment, calculated in your browser.

Who answers for security

In many hotels, security is scattered: the MSP looks after part of the network, the PMS supplier looks after the application, the front desk looks after the passwords, and nobody answers for the whole. Tools help, but what is usually missing is someone who sets the priorities, holds the suppliers to account and reports to leadership.

In hotels that are not large enough for a full-time security manager, this role can be carried out by a virtual CISO. The split of tasks between the hotel and each supplier is in the guide to IT responsibilities between the hotel and its suppliers.

Our hotel cybersecurity team can carry out an initial assessment of your security posture and identify the priorities for action.

Hotel cybersecurity guides

• Hotel cybersecurity risks: the recurring attack surfaces and real cases from the sector.
• 2026 hotel cybersecurity risk report: the sector figures, with sources.
• How to protect a hotel against ransomware: prevention, response and recovery.
• Pix scams and booking fraud: how to protect the front desk and reservations.
• AI scams against hotels: phishing, voice deepfakes and OTA account takeover.
• Guest Wi-Fi security: segmentation and connection logs.
• PCI DSS for hotels: scope, the SAQ and the requirements of version 4.0.1.
• LGPD for hotels: what the law requires in practice.
• Data breach at a hotel: what to do in the first 48 hours.
• IT supplier management: contracts, access and exit without dependency.
• Virtual CISO for hotels: when it makes sense and what it includes.

Sources

• ANPD, Resolução CD/ANPD nº 15, Regulamento de Comunicação de Incidente de Segurança (the security incident reporting regulation, April 2024, in Portuguese), in.gov.br
• PCI Security Standards Council, PCI DSS v4.0.1 and Self-Assessment Questionnaires, pcisecuritystandards.org
• MGM Resorts International, Form 8-K (October 2023), sec.gov