Although no confirmed connections exist, it is becoming increasingly evident that hospitality is an attractive target for cybercriminals, and the risks extend far beyond any individual technology platform.
For accommodation operators, the challenge is no longer solely about securing their property management systems. They must also understand where their guest information is sent, who has access to it, and how many different platforms are involved in processing a single booking.
One of the most concerning trends is the increasing sophistication of fraudulent messages being sent directly to guests.
We're seeing reports of guests receiving WhatsApp messages, emails, and SMS containing legitimate reservation details, including property names, travel dates, and booking references.
The messages often claim there's a problem with the booking or that payment details need to be verified to prevent cancellation. They then direct guests to fraudulent websites designed to resemble legitimate booking platforms.
What makes these scams particularly effective is how accurate the information is.
A message referencing an upcoming stay, the correct accommodation provider, and genuine reservation details is far more convincing than a generic phishing email.
Unfortunately, the presence of legitimate booking information doesn't necessarily tell us where that information was obtained.
Consider the journey of a typical accommodation reservation.
A guest books through an online travel agency. Their information is transmitted through a channel manager into a property management system. From there, it may be shared with guest communication platforms, digital check-in providers, revenue management systems, payment services, and other applications.
Increasingly, AI tools are also being connected to these systems.
Each integration serves a purpose, and collectively they make accommodation businesses more efficient. However, every additional platform that processes guest information introduces another potential point of exposure.
Even when an accommodation operator's primary systems are secure, a vulnerability or compromised credential at an external provider could potentially expose information accessed through that connection.
This is one of the biggest challenges facing hospitality technology today.
A business can have excellent security practices and still be exposed to risks originating outside its own systems.
There's another possibility that's often overlooked.
Sometimes, the source of a fraudulent booking message may be the guest's own email account.
Stolen email credentials are a widespread cybersecurity problem. Phishing, malicious software, or reused passwords across multiple websites can compromise individual Gmail, Outlook, and other email accounts.
If a threat actor gains access to someone's inbox, a booking confirmation may contain everything needed to create a convincing scam: the accommodation provider, travel dates, reservation reference, and contact information.
The threat actor doesn't necessarily need access to a hotel system or booking platform.
This is why we need to be careful about automatically attributing every fraudulent guest message to a breach of an accommodation provider's technology.
Accurate reservation information is a reason to investigate, not proof of where a compromise occurred.
Artificial intelligence is rapidly changing how accommodation businesses operate.
From automated guest communications to revenue management and operational workflows, AI has enormous potential to improve productivity and guest experiences.
However, the increasing use of AI agents and applications connected through APIs introduces another layer of risk.
Some operators connect external AI tools directly to their systems, giving them access to reservation information, guest contact details, and operational data.
The question operators need to ask is simple: Do you know exactly what information your AI tools can access, where it's stored, and who is responsible for protecting it?
An AI application doesn't need unrestricted access to every guest record to perform a relatively simple task.
As an industry, we need to become much more disciplined about limiting access to the information genuinely required, reviewing API permissions and removing connections that are no longer needed.
Innovation and security must develop together.
The recent incidents should serve as a timely reminder to review cybersecurity practices across the entire business.
Start by auditing the third-party applications connected to your accommodation systems. Understand what each application does, what information it can access, and whether you still need it.
Review API credentials and access permissions, especially for applications connected for several years without reassessment.
Enable multi-factor authentication wherever possible, including email accounts, booking channel extranets and other critical business systems.
Educate staff about phishing attempts and unusual payment requests, and consider proactively warning guests about fraudulent messages.
Most importantly, establish a clear process for reporting suspicious activity. The sooner unusual behaviour is identified, the sooner it can be investigated.
Hospitality has become an incredibly connected industry.
That's one of our greatest strengths, but it also means cybersecurity can no longer be viewed as the responsibility of a single software provider.
Technology companies must secure their own infrastructure, monitor suspicious activity, and implement appropriate controls around the access they provide. They must also be transparent when incidents occur.
But no individual provider has complete visibility or control over the internal security of every independent platform connected to its systems.
Accommodation operators also have a responsibility to understand the technology they use, manage access appropriately, and educate their teams and guests.
Guests also need to stay cautious about unexpected communications, particularly those requesting payment information.
The recent wave of incidents is concerning, but it also presents an opportunity for our industry to improve how we approach cybersecurity.
We shouldn't respond by becoming fearful of technology or avoiding innovation.
Instead, we need to understand better how our systems interact, be more disciplined about data access, and be more proactive in protecting the information entrusted to us.
So, the next time your technology provider introduces additional security measures or asks you to update your credentials, don't resist it. It might add an extra step to your day, but it's a small price to pay for protecting your business and your guests.
Security isn't one person's responsibility. It's everyone's.
.png)
