Hotel cybersecurity risk report 2026
Hospitality remains among the most targeted commercial sectors in the world. A survey published in 2025 found that 82% of US hotels suffered a cyberattack during the 2024 peak season, and the average cost of a breach in hospitality now exceeds US$4 million. This report brings together the figures, the threat groups active in Latin America and the defence gaps these attacks exploit.
- 82% of US hotels suffered a cyberattack in a single peak season (VikingCloud, 2025)
- The average cost of a breach in hospitality now exceeds US$4 million per incident (IBM, 2025)
- 82% of security detections in 2025 did not involve malware: attackers prioritise stolen credentials, a general figure, not specific to hospitality (CrowdStrike, 2026)
- Hospitality and retail had the highest rate of breaches via third-party suppliers among the sectors analysed, 52.4% (SecurityScorecard, 2025)
- 48% of hotel IT leaders doubt their front-line staff would identify AI-generated phishing (VikingCloud, 2025)
- Groups such as RevengeHotels (TA558) have documented activity aimed at hotels in Brazil and Latin America
This report brings together public data released between 2021 and 2026 by researchers, security vendors, the specialist press and authorities, listed in the Sources section. It is not original research. The text separates three types of evidence: surveys and incidents specific to hospitality; general threat data, flagged as such, that also applies to hotels; and threat intelligence on groups acting against the sector, which describes campaigns, not confirmed breaches. The reading of this evidence for Brazilian hotels is HotelTI's analysis.
The numbers behind the 2026 threat landscape
According to the VikingCloud (2025) survey of US hotels, covering the 2024 summer peak season:
- 82% suffered a successful cyberattack during the season
- 90% of hotel IT and security leaders reported at least one attempted attack
- 58% of properties faced five or more attacks in a single peak season
- 44% of breached properties had 12 hours or more of critical system downtime
The financial picture follows the frequency. For properties hit by ransomware aimed at the operation and not just the data, the cost rises even further when check-in, the booking engine and keyless entry are all down at the same time during a period of high occupancy.
How attacks have changed
Credentials instead of malware
Across the organisations analysed in the CrowdStrike 2026 Global Threat Report, 82% of security detections in 2025 did not involve malware. The figure is not specific to hospitality, but the implication for hotels is clear, because the operation depends on systems accessed with a username and password, such as the PMS and POS. Attackers obtain staff credentials that have been leaked, reused or captured through phishing and log straight into the PMS, booking integrations and back-office networks, reaching high-value systems without triggering antivirus tools designed for file-based threats.
AI-generated phishing at scale
According to the same VikingCloud survey, almost half of hotel IT and security leaders say they doubt their front-line staff could identify advanced AI-generated phishing. The front desk, which handles hundreds of guest communications per shift, cannot manually screen every message for signs of AI generation.
Operational disruption as the goal
Ransomware-as-a-service groups have moved beyond targeting only data encryption and now sabotage the operation: interrupting bookings, disabling check-in and locking keyless entry systems until payment ends the disruption. Many groups also publish stolen data on leak sites whether or not the ransom is paid, which removes payment as a way of containing the consequences.
The infrastructure that widens the attack surface
Hotels connect the PMS, POS terminals, booking integrations, guest Wi-Fi, smart room devices and supplier systems on a single operational network. Each category below is a common entry point or lateral movement path in incidents in the sector.
| System | Impact |
|---|---|
| POS terminals | Restaurants, bars and spas attract persistent harvesting of card data; attackers often stay for months before exfiltrating data in bulk, and, depending on the scope and type of validation, PCI DSS requires quarterly scans and periodic penetration tests. |
| Smart room IoT | TVs, digital minibars and automated lighting run firmware with infrequent patches and default credentials that are rarely changed. |
| Third-party suppliers | Hospitality and retail had the highest rate of third-party breaches among the sectors analysed in 2025, 52.4%, according to SecurityScorecard; supplier access to the PMS and loyalty systems creates entry points outside the hotel's direct control. |
| Guest Wi-Fi | Poorly segmented networks give anyone connected a potential path to corporate management systems, including the PMS. |
Confirmed breaches, 2025 and 2026
Attackers accessed guest booking data, such as names, emails, phone numbers, addresses and stay details, through compromised partner hotel accounts. Financial data was not affected, but the information soon appeared in WhatsApp and SMS scams impersonating the hotel, with the correct hotel name, dates and booking number (TechCrunch).
It is not the first time delays have weighed on the platform: in 2021, the Dutch data protection authority fined Booking.com €475,000 for reporting a 2019 incident 22 days late (Autoriteit Persoonsgegevens).
The group that owns the Best Western, WorldHotels and Sure Hotels brands identified on 22 April 2026 unauthorised access to a web application in its reservation system, which had begun on 14 October 2025. Booking numbers, names, contact details, addresses, stay dates and specific guest requests were exposed; card data was not held in that system (SecurityWeek).
The prolonged presence gave the attackers time to learn the profiles of frequent guests, which feeds targeted fraud long after the access has ended.
The Australian aparthotel chain identified unauthorised access to a database through a vulnerability at a third-party service provider, exposing guest names and contact details in records from before June 2025 and, for some of them, dates of birth (ABC News).
The Californian luxury resort operator detected unauthorised activity on its network in January 2026 and began notifying the people affected at the end of April, a gap that shows how long investigating an incident can take (breach notice).
A campaign against European hotels sent the front desk emails imitating Booking.com cancellations with large charges. The link led to a fake page with a CAPTCHA and a Windows "blue screen" that instructed the employee to paste and run a command, installing a remote access trojan (DCRat) on the computer (The Hacker News). Standard phishing training rarely covers fake error screens.
Threat groups targeting hospitality in Latin America
Some groups operate with a specific focus on hospitality. In Latin America, two have documented activity against the sector, and one of them, RevengeHotels, targets Brazilian hotels directly.
RevengeHotels (TA558)
The RevengeHotels group, also tracked as TA558, concentrates its operations on hotels in Brazil, Argentina, Chile, Mexico and Costa Rica. Its core approach is social engineering: emails with fake booking or quote requests aimed at the front desk and the reservations office, with the goal of compromising the PMS. Instead of demanding a ransom, the group steals card data from booking queues and sells access to compromised terminals on dark web forums, including using AI tools to generate more convincing phishing lures (Kaspersky Securelist).
Poco RAT and Dark Caracal
The Dark Caracal group uses the Poco RAT remote access trojan in Spanish-language phishing campaigns, with financial lures such as invoices, against companies in the mining, manufacturing, hospitality and utilities sectors, mainly in Venezuela, Chile, the Dominican Republic, Colombia and Ecuador. The aim is prolonged, silent access to the compromised computers (The Hacker News). The documented focus is on Spanish-speaking countries, not Brazil.
Where the defence gap lies
One gap that deserves attention is the reliance on a standard firewall and antivirus as the main defence, with active vulnerability scanning, dark web monitoring and penetration testing treated as the exception, not the routine.
Many hotels rely on perimeter controls aimed at threats that attackers have been getting around for years. Credential-based intrusions, supplier compromise and AI-generated phishing operate in the space between basic perimeter tools and the more active monitoring that would detect them.
Three controls are often missing and would help detect these attacks earlier:
- Active vulnerability scanning of PMS, POS and booking integrations, at a frequency that keeps pace with how often those systems change
- Dark web monitoring to identify compromised staff credentials before they are used to log in
- Social engineering training calibrated for AI-generated content, not for generic phishing
Why the gap persists
Three factors explain why the control gap described above does not close on its own: finding qualified security staff is a persistent challenge for many hotels, the IT budget usually competes with investments more visible to guests, and many hotels still run legacy systems that suppliers no longer update.
Staff and budget
Hospitality competes for security professionals with financial services, technology and healthcare, sectors with higher salary budgets. Where there is no dedicated security role, the responsibility falls on IT generalists or front office managers. Investment tends to follow incidents rather than anticipate them: properties without a recent breach direct capital towards guest-facing technology before strengthening infrastructure.
Legacy systems and loyalty
PMS software, POS platforms or network infrastructure without active patching are a permanent attack surface, and replacing them requires capital and downtime that many properties put off. Loyalty accounts, with real monetary value in convertible points, suffer continuous credential stuffing attacks using lists leaked from other sectors, a risk often treated as a marketing concern rather than a security one.
Contractual gaps with suppliers
Many hotel supplier contracts do not include clear security obligations, audit rights or breach notification deadlines, even though supplier access to the PMS and loyalty systems has been a confirmed entry point in several recent incidents.
What 2026 adds to the threat profile
Deepfake social engineering has moved from concept to operational use: attackers generate convincing voice or video impersonating executives or IT support to trick staff into installing malware or handing over credentials. RaaS groups now publish stolen data on leak sites whether or not the ransom is paid, which means that notifying the ANPD (Brazil's data protection authority) and the affected guests may be necessary even when the encrypted data is recovered, because the stolen copy is still circulating.
Where to start
First map which of the controls above are missing and which attack surfaces in the infrastructure table are not monitored. Our guide to hotel cybersecurity risks covers these attack surfaces and the baseline of controls in more depth.
How HotelTI can help
We work with hotels and hotel groups in Brazil on the specific risks covered in this report. Our assessment maps the attack surface across the whole operation, including the PMS, POS, guest Wi-Fi, supplier connections and staff exposure, and returns a prioritised list of actions rather than a generic report, covering network and infrastructure, access and identity, supplier risk, hotel technology and compliance with the LGPD and PCI DSS.
If you want to understand where your controls stand against the threat level described in this report, talk to our hotel cybersecurity team. For hotels that have already suffered an incident or are preparing for a compliance audit, get in touch directly.
Sources
- VikingCloud, Peak Season, Peak Risk: The 2025 State of Hospitality Cyber Report (2025), vikingcloud.com
- IBM, Cost of a Data Breach Report (2025), ibm.com
- CrowdStrike, 2026 Global Threat Report, crowdstrike.com
- SecurityScorecard, 2025 Global Third-Party Breach Report, securityscorecard.com
- TechCrunch, Booking.com confirms hackers accessed customers' data (April 2026), techcrunch.com
- Autoriteit Persoonsgegevens, Booking.com fined for delay in reporting data breach (2021), autoriteitpersoonsgegevens.nl
- SecurityWeek, BWH Hotels says hackers had access to reservation data for 6 months (2026), securityweek.com
- ABC News, Quest Apartment Hotels data security breach (August 2026), abc.net.au
- Emery Reddy, JC Resorts LLC data breach (2026), emeryreddy.com
- The Hacker News, Fake booking emails redirect hotel staff (January 2026), thehackernews.com
- Kaspersky Securelist, RevengeHotels attacks with AI and VenomRAT across Latin America, securelist.com
- The Hacker News, Dark Caracal uses Poco RAT to target Spanish-speaking enterprises in Latin America (March 2025), thehackernews.com
Hotel cybersecurity
A risk assessment covering the PMS, POS, guest Wi-Fi, suppliers and LGPD compliance.
View service- IT risk assessment
- Supervision of external monitoring
- Supplier control
- LGPD compliance
Related reading
Which parts of a hotel do attackers target most?
Point-of-sale terminals in restaurants, bars and spas attract the most persistent targeting for payment card data. Property management systems (PMS) are high-value targets because they store guest data, payment tokens and booking integrations. Poorly segmented guest Wi-Fi networks give attackers a route from the public network to internal systems, and connections with third-party suppliers are the broadest category of exposure outside the hotel's direct control.
What does ransomware-as-a-service mean in practice for hotels?
RaaS groups sell ransomware tools and infrastructure to affiliates who carry out the attacks. In hospitality, the target is usually the operation and not just the data: bookings go offline, check-in terminals fail and keyless entry stops working. Disruption during peak season is the point of leverage. Many groups also publish stolen data on leak sites whether or not the ransom is paid.
Does a hotel need a penetration test?
In many cases, yes. Hotels in scope for PCI DSS may be subject to the penetration testing requirements that apply to their environment; the scope and validation method depend on how payments are processed and which systems can affect the security of the cardholder data environment. Beyond compliance, a penetration test identifies credential exposure and lateral movement paths that standard perimeter tools do not detect, which is especially relevant at properties with the PMS, POS and booking integrations spread across multiple supplier systems.
What does the LGPD require when a hotel suffers a breach of guest data?
Under ANPD Resolution CD/ANPD No. 15/2024, hotels must notify the ANPD (Brazil's data protection authority) and the affected data subjects within 3 working days of becoming aware that a security incident has affected personal data in conditions of significant risk or harm. The deadline runs from the moment the hotel knows the incident affected personal data, not from the end of the investigation, and further information can be sent later; small processing agents have double the deadline.
How do smart room IoT devices create network risk?
Smart TVs, digital minibars and automated lighting usually run firmware with infrequent update cycles and connect to the same hotel network. Without deliberate segmentation, an attacker who compromises one of these devices gains a foothold that can provide lateral access to the PMS or administrative systems.
Find out where your hotel's biggest risks are
Our free assessment covers the POS, PMS, guest Wi-Fi, supplier access and staff exposure, with a prioritised list of actions at the end.