Hotel cybersecurity risks: what many hotels still do not address
Hotels hold payment data, identity documents and travel history in one place, inside an IT environment that connects the PMS, POS, guest Wi-Fi and many external suppliers. This guide covers the four attack surfaces that recur in the sector, the LGPD obligations that tend to fall off the radar and how to build a defensible security baseline.
Hotels handle a volume of sensitive personal data that few other retail sectors reach: payment card numbers, copies of passports or national ID cards, home addresses, stay history and, in many cases, loyalty programme data that is worth real money. That volume of data attracts attention. And the IT environment behind a hotel operation (PMS, POS, guest Wi-Fi, electronic locks and integrations with OTAs) usually grows by addition over the years, without security keeping pace.
- One of the largest breaches ever recorded in the hotel sector, at Starwood, affected around 339 million guest records and went undetected for four years.
- Four attack surfaces are often exposed at the same time: the PMS, the POS, guest Wi-Fi and integrations with booking platforms.
- Under ANPD Resolution No. 15/2024, incidents that may cause relevant risk or harm must be reported to the ANPD (Brazil's data protection authority) and to the data subjects within 3 business days of becoming aware of them; small processing agents have twice the time.
- Keeping copies of identity documents with no defined retention period is unlikely to meet the LGPD's principles of purpose and necessity.
- In 2023, a ransomware attack affected bookings, check-in and digital keys at MGM Resorts in the US, with an impact the company itself estimated at around US$100 million on the quarter's results.
Why hospitality is a persistent target
One of the most cited cases in the sector is Marriott, which revealed in 2018 that attackers had kept undetected access to the Starwood reservations database for around four years, affecting around 339 million guest records according to the final decision of the UK data protection authority (ICO), including, in some of the records, passport numbers. Two years later, the same chain suffered a second breach, this time through the compromised login of a franchised property, affecting 5.2 million guests. Neither case relied on a new technique: in the 2020 incident, the entry point was a compromised credential; in the Starwood case, what weighed most was the four years without detection.
In September 2023, MGM Resorts, one of the largest resort and casino operators in the United States, had bookings, check-in and digital keys affected at its US properties for several days. In a filing with the SEC, the company estimated a negative impact of around US$100 million on the quarter's results. According to reports at the time, the attack began with a social engineering call to the IT help desk, not with a technical flaw.
The four most important attack surfaces
Incidents reported in the sector usually involve at least one of these four areas.
Property management systems (PMS)
The PMS is a hotel's central system: bookings, guest profiles, payment history and, in many properties, room access control all pass through it. Frequent risks are outdated versions without the latest patches, weak access controls, administrator credentials shared among staff and no multi-factor authentication. There have been documented cases of attackers staying inside PMS systems for more than a year without being detected, collecting data continuously.
Point of sale (POS) terminals
Hotel restaurants, bars and spas have been targeted by POS malware campaigns designed specifically to steal card data at the moment the card is swiped or inserted. The most effective mitigation is still network segmentation: isolating the POS terminals from the corporate network and the PMS limits how far an attacker can move after compromising a single terminal.
Guest Wi-Fi
When the guest network is not completely isolated from the operational network, anyone connected to the lobby Wi-Fi has, in theory, a network path to internal systems. This is one of the most recurrent findings in hotel security assessments: segmentation exists on paper, but in practice leaves gaps between poorly configured VLANs.
Booking platforms and OTA integrations
API integrations with booking engines and online travel agencies (OTAs) expose names, email addresses, phone numbers and, in some cases, partial card data. When these integrations are compromised, the exposed data feeds phishing campaigns that pose as booking confirmations, often aimed at the front desk team itself.
LGPD obligations hotels tend to overlook
Even when the PMS, the booking engine or the loyalty system is operated by an outsourced supplier, in many of these flows the hotel still acts as the controller of its guests' data under the LGPD (Brazil's data protection law), and the supplier as the processor. This means setting out in contract the data protection responsibilities of the suppliers that process guest data on the hotel's behalf, not just relying on the supplier's privacy policy.
A common gap is the lack of a clear retention policy: it is not unusual to find hotels that keep card tokens, document copies and booking histories indefinitely, with no defined deletion period.
The clock for notifying the ANPD and the data subjects starts when the hotel becomes aware that the incident has affected personal data, not when the internal investigation ends. Small processing agents have twice the time. Failing to report, or reporting late, can be treated by the ANPD as an infringement in its own right, on top of the security failures that led to the incident.
Copies of identity documents deserve special attention: storing them in a shared folder with no access control, no retention period and no specific legal justification is unlikely to meet the requirements of the LGPD, even if the original collection was legitimate for guest registration purposes.
What a credible security baseline looks like for hotels
Hotels that implement the controls below can show regulators and insurers a defensible security posture when an incident happens. In hospitality, incidents happen regularly; the difference lies in the speed of containment and the ability to document what was done.
| Control | Why it matters |
|---|---|
| Network segmentation | Separating guest Wi-Fi, POS, PMS and back office into distinct VLANs is the single control with the greatest impact against lateral movement. |
| MFA on external systems | Compromised credentials are among the most common initial access vectors; MFA blocks a large share of the attacks that depend only on a password. |
| Protected backups and tested recovery | Copies that the production environment cannot alter or delete, with the restoration of critical systems tested for real, are what allow the hotel to operate again after ransomware. |
| Privileged accounts | Named administrator accounts, separate from day-to-day use and kept in a credential manager, limit the damage of a stolen password. |
| Supplier remote access | Permanent support access can become a way in; grant it on demand, with MFA and logging, and review regularly who still has access. |
| Patching cadence | PMS and POS systems are often years behind on updates; what cannot be patched needs to be isolated. |
| Phishing simulations | A one-off annual training session does not keep up with front desk staff turnover; quarterly simulations keep attention calibrated. |
| Defined data retention | Retention periods set by purpose and legal obligation, with deletion of document copies that do not need to be kept, reduce the surface exposed in a breach. |
| Incident response plan | It needs to cover hotel-specific scenarios: the PMS down during check-in, communication with guests and regulatory notification within 3 business days. |
The security requirements for payment card data are maintained by the PCI Security Standards Council. Guidance from Brazil's National Data Protection Authority on notification deadlines and obligations is available at gov.br/anpd (in Portuguese).
If you want to understand where your hotel's greatest exposure lies, our hotel cybersecurity team carries out an initial assessment covering the PMS, POS, guest Wi-Fi, suppliers and LGPD compliance, and returns a prioritised list of actions instead of a generic report.
Sources
- ANPD, Resolução CD/ANPD nº 15, Regulamento de Comunicação de Incidente de Segurança (security incident reporting regulation, April 2024, in Portuguese), in.gov.br
- MGM Resorts International, Form 8-K (October 2023), sec.gov
- PCI Security Standards Council, PCI DSS v4.0.1 and Self-Assessment Questionnaires, pcisecuritystandards.org
Hotel cybersecurity
Risk assessments, network segmentation, MFA and supplier management for hotels and resorts.
View service- IT risk assessment
- Network and Wi-Fi segmentation
- Supplier control
- Incident response
Related reading
Why are hotels a favourite target for cybercriminals?
Hotels concentrate several types of high-value data in a single environment: payment card data, identity documents, loyalty programme credentials and travel itineraries. That concentration, combined with a complex IT environment involving the PMS, POS, guest Wi-Fi and integrations with booking platforms, creates a large attack surface. Security investment in the sector tends to be lower than in other sectors that handle equally sensitive data, which makes hospitality a comparatively easier target.
What does the LGPD require of a hotel after a data breach?
Under ANPD Resolution No. 15/2024, the hotel must notify the ANPD and the affected data subjects within 3 business days of becoming aware that a security incident has affected personal data in a way that may cause relevant risk or harm. Small processing agents have twice the time. The deadline starts when the hotel has reasonable grounds to believe the data has been affected, not when the investigation ends.
How long can a hotel keep copies of guests' identity documents?
Retention needs to rest on a specific legal basis and be limited to the minimum period needed for that purpose, usually compliance with a legal guest registration obligation. Keeping these copies indefinitely, for example in a shared folder without access control, is unlikely to meet the requirements of the LGPD. The hotel needs a documented retention policy, a defined deletion period and control over who can access these files.
What is the biggest security risk in property management systems (PMS)?
The PMS concentrates bookings, guest profiles, payment history and, in many cases, room access control. The main risks are credentials obtained through phishing or reused from other breaches, delayed security patches and lateral movement from a less protected third-party system connected to the PMS. Network segmentation and multi-factor authentication are the most cost-effective mitigations for this risk.
What does a basic cybersecurity baseline for a hotel look like?
A credible baseline includes: multi-factor authentication on all administrative and PMS access; network segmentation separating guest Wi-Fi, operational systems and the cardholder data environment; regular patching of the PMS and POS; periodic phishing training for front desk staff; an incident response plan with a regulatory notification checklist; encrypted backups that are tested regularly; and a security review of every integrated supplier.
Want to know where your hotel's greatest exposure lies?
Take HotelTI's free cybersecurity self-assessment, based on real risks in the PMS, POS, guest Wi-Fi and suppliers.