How to protect a hotel against ransomware: prevention, response and recovery

In September 2023, MGM Resorts, one of the largest resort and casino operators in the United States, had bookings, check-in and digital room keys disrupted at its US properties for several days. In a filing with the SEC, the company estimated a negative impact of about US$100 million on the properties' adjusted EBITDAR for the quarter. According to reporting at the time, the attack did not exploit a sophisticated vulnerability: it began with a social engineering call to the IT help desk, which reset an employee's password. The rest of the story is what this article sets out to prevent.

Many hotels combine three things that interest ransomware groups: legacy POS and PMS systems with overdue patches, card data and identity documents concentrated on a few servers, and an operation that cannot stop. It is the last one that gives the attacker leverage. An office can work for a few days without its ERP; a hotel with 200 guests arriving and no contingency procedure can barely operate for a few hours without the PMS.

How the attack happens in a hotel

Modern ransomware is not a virus that arrives and encrypts everything in minutes. It is a human-operated attack, often carried out by affiliates of ransomware-as-a-service (RaaS) groups who buy initial access from third parties and spend weeks inside the network before acting. In a hotel, the typical sequence is as follows.

Initial access

Frequent entry points include a phishing email to the front desk or finance team (disguised as a booking confirmation, an OTA invoice or a supplier payment slip), remote access (RDP or VPN) exposed to the internet without multi-factor authentication, credentials reused from earlier leaks and, increasingly, the remote access that PMS, POS and door lock suppliers keep with shared passwords that are never changed. Social engineering calls to the IT help desk, asking for a password reset on behalf of a manager, complete the list.

Reconnaissance and lateral movement

Once inside, the attacker maps the network: where the PMS is, where the file servers are, who has domain administrator privileges and, above all, where the backups are. In hotels where guest Wi-Fi, POS and back office share the same flat network, that mapping can take just a few hours. The attacker often spends days or weeks in the network before being detected (Mandiant's M-Trends 2026 report gives a global median of 14 days), and in some cases months.

Exfiltration and destruction of backups

Before encrypting, the attacker copies whatever has extortion value (the booking database, copies of guest documents, card data, contracts, payroll) and then deletes shadow copies, backup repositories reachable over the network and, when possible, the cloud snapshots themselves. Part of this work is usually automated with off-the-shelf tools. That is why backups sitting on a network share visible to the same user do not count as backups.

Encryption and double extortion

Encryption is usually triggered outside business hours, often in the early hours of a weekend or on the eve of a public holiday, when fewer people are around to notice and react. The ransom demand comes on two fronts: pay to receive the decryption key, and pay again so the stolen data is not published. Paying does not guarantee that the data is deleted: there are cases of groups publishing or reselling data even after payment.

Why hotels are an attractive target

Three factors leave hospitality particularly exposed, and none of them is solved by buying better antivirus.

Total operational dependence. Bookings, check-in, electronic door locks, restaurant POS, billing and OTA integration all go through the PMS. When it stops, the hotel cannot receive guests, take payments, issue room cards or know who is in which room in the normal way. RaaS groups have understood this and started attacking the operation instead of just encrypting files. Our 2026 hotel cybersecurity risk report (in Portuguese) describes a group heavily concentrated in Latin America that widened its scope to hospitality for exactly this reason.

Predictable seasonality. There are dates when the hotel cannot stop: New Year's Eve, Carnival, long holiday weekends, events in the city. An attack on those dates does far more damage than the same attack on a low-season Tuesday, and it increases the pressure to decide quickly, including about paying. The response plan needs to consider that scenario, not a quiet day.

Many suppliers with remote access. PMS, POS, door locks, CCTV, Wi-Fi, room automation, booking engine, channel manager: each with a different supplier, each supplier with its own form of remote access, and often nobody at the hotel can list all of them. IT supplier management (in Portuguese) is, in practice, management of the attack surface.

The five controls that reduce the risk most

There are dozens of possible measures. In our assessment, the five below account for most of the risk reduction, and they are among the questions cyber insurers tend to ask before issuing or renewing a policy. The five work together: none replaces the others.

A sixth control deserves a mention: endpoint detection and response (EDR) on all servers and workstations. The catch is that an EDR tool is only as effective as the team watching its alerts. Installing EDR with nobody looking at 3am on a Sunday gives a false sense of protection. If the hotel has nobody to monitor it, the contract needs to include that service from the supplier.

What to do in the first hours of an attack

The order of actions in the first hours decides whether the incident lasts days or months. What follows is the script a hotel response plan needs to cover, adapted to what happens on a property.

Contain without destroying evidence

• Isolate, preferably without shutting down. Unplug the network cable or turn off Wi-Fi on the affected machines and, where possible, leave them on until whoever leads the response says what to do next. Shutting a machine down wipes its memory, which is where the most valuable forensic evidence sits and, in some cases, the encryption keys still in use. If encryption is under way and the machine cannot be isolated, shutting it down may be the least bad option; that decision should be set out in the plan.
• Isolate the affected segment. If the network is segmented, block traffic between the affected VLAN and the rest. If it is not, this is when you find out why segmentation mattered.
• Close the way in. Disable suspicious remote access, invalidate VPN sessions and reset credentials, starting with domain administrator accounts, with guidance from whoever leads the incident response so as not to alert the attacker or destroy evidence.
• Preserve the logs. Firewall, VPN, email server, PMS and EDR. Many systems overwrite logs within a few days; export them to an isolated location before that happens.

Activate the chain of decisions

• Call the insurer early. Many cyber insurance policies require notice within a short period and may not cover payments or response costs that were not approved in advance. The deadline that counts is the one in the hotel's policy, and it should be in the response plan. Many policies also set which incident response firms can be hired.
• Involve the lawyers and the DPO. When the hotel confirms an incident that involves personal data and may cause relevant risk or damage to the people affected, CD/ANPD Resolution No. 15/2024 gives 3 business days to notify the ANPD and those people. That deadline does not wait for the investigation to end: the notice can be supplemented later. Because ransomware usually involves guest data, this assessment needs to start in the first hours, with the hotel's lawyers.
• Decide who talks to whom. Guests with bookings in the coming days, OTAs, the card acquirer, PMS and door lock suppliers, staff. A single person authorised to communicate externally avoids contradictory information.

Keep the hotel running

While IT and the response firm work, the hotel needs to operate. That means having a contingency procedure ready in advance: a printed list of the day's arrivals (exported from the PMS every day to a safe location), emergency key cards or mechanical keys for the door locks, a standalone card machine that does not depend on the hotel's network, and a paper check-in form. Hotels that prepare this tend to lose a few hours of efficiency; hotels that do not risk losing guests.

To pay or not to pay the ransom

Europol, the UK's NCSC and the FBI recommend not paying, and experience supports that position: the decryption key may fail or recover only part of the data, payment does not remove the attacker from the network (the access stays there until it is eradicated) and it does not stop the stolen data from being published. Paying also signals to the group that the hotel pays, which increases the chance of a second attack.

There is also a legal dimension that hotels in Brazil often overlook. No Brazilian law currently prohibits payment specifically, but paying may breach international sanctions if the recipient is a person or entity sanctioned, for example, by OFAC, the US Treasury's sanctions office, or by the European Union. Members and infrastructure of well-known groups such as LockBit have already been targeted by those sanctions. The risk is higher for hotels that belong to international chains or that rely on insurers, reinsurers or banks operating in those markets, which may refuse to take part in a payment. The decision needs to go through the lawyers and the insurer, with a sanctions check, and should never be taken by the IT team under pressure in the first hours.

When the decision to pay is taken, usually because there is no viable backup and the operation has stopped, it should involve a specialist negotiator, the insurer's prior approval and a rebuild plan that treats the decryption key as a shortcut, not as the solution. The attacker stays in the network until the network is rebuilt.

Recovery: the mistake of restoring too fast

A frequent mistake in recovery is restoring the backup onto the same infrastructure the attacker is still in. Ransomware groups leave persistence mechanisms behind (scheduled tasks, administrator accounts created during the attack, remote access tools, group policy changes that disable the EDR) precisely so they can come back after the restore. If those mechanisms are not removed, the attacker can return weeks later, when attention has dropped.

The sequence that works is: confirm the attacker has been removed (a forensic investigation, even a short one), validate the backups on isolated hardware before trusting them, rebuild compromised servers from scratch instead of "cleaning" them, reset all privileged credentials, and only then restore in priority layers: PMS, door locks and POS first, then the booking engine and OTA integrations, then everything else. Recovery time depends on the scope of the attack, the quality of the backups and the availability of suppliers. That is why the hotel should set a recovery time objective (RTO) for each critical system before any incident, for example 72 hours for the PMS, and test whether it can be met.

The rebuild is also the best moment to harden the environment: MFA where it was missing, the segmentation that was never done, EDR everywhere, centralised logs. Doing it during the rebuild costs a fraction of what it would cost later, and at that moment the board tends to approve it.

Regulatory duties during the incident

A ransomware attack on a hotel can trigger three notification fronts, and they run in parallel with the technical recovery, not after it.

Communication with guests deserves special care. Those with bookings in the coming days need to know that check-in will work, even if on paper; those who stayed in recent months may need to be told that documents or card data were exposed. The tone and timing of those messages are part of the response plan, not improvisation.

The role of a hotel IT consultancy

Protecting a hotel against ransomware involves decisions (which controls to prioritise, which backup supplier, which EDR tool, what to require in the contract of each supplier with remote access) and execution (running the backup, monitoring alerts, applying patches, rebuilding servers). They are different skills, and mixing them up is one of the reasons hotels buy tools that nobody operates.

HotelTI works in the first group. We assess the hotel's exposure to ransomware, set investment priorities, help select the tools and partners that fit the size of the property, write and rehearse the response plan with the team and, when an incident happens, coordinate the suppliers and the communication with the insurer, the lawyers and the ANPD, the role we play as the hotel's Virtual CISO. Technical operation stays with the IT provider or specialist supplier hired for it, under a contract and service level we help define. If you want to understand that split in detail, read IT consultant or MSP: which one a hotel needs (in Portuguese).

For a first reading of your hotel's exposure, the free hotel cybersecurity assessment covers identity and access, network, payments and compliance in 12 questions, with no sign-up. External resources: the ANPD's guidance on incident reporting is at gov.br/anpd (in Portuguese), and CERT.br, Brazil's national incident response team, publishes incident handling material for organisations in Brazil. The No More Ransom project, run by Europol and partners, offers free decryption tools for some ransomware families.

Sources

• MGM Resorts International, Form 8-K (October 2023), sec.gov
• Mandiant (Google Cloud), M-Trends 2026: Data, Insights, and Strategies From the Frontlines (2026), cloud.google.com