Between May 2014 and December 2015, six high-profile companies within the hospitality industry suffered customer data breaches. Malware, compromised card processing systems, gift shop point-of-sale registers, and hotel payment systems were all to blame for the spate of breaches.
From reservations and payment processing to rewards programs and guest services, customers are interacting with hotels and hospitality entities in a wide array of methods. The industry has built a business model of many points of contact with their customers.
These methods of reaching customers on many levels has become more than touch points in a customer service process – they have become vulnerabilities that could result in serious cyber breaches.
The Vulnerabilities
Such vulnerabilities are making the hotel and hospitality industry easy targets for hackers. As a result, every hospitality business – hotels, restaurants, reservation system vendors, and more – is facing the very real threat of a security incident. A restaurant chain with over 3,600 stores in 45 states had their customers’ payment card information stolen. A breach at a global hotel group impacted more than 1,200 of its properties. Another hotel chain had two breaches in two years, with customer data once again being compromised.
Hospitality
Businesses most targeted by hackers are ones that collect significant amounts of personal data on their customers. The hospitality industry is a frequent target because they collect payment card data, addresses, phone numbers, and other identifiable information that are sought by cyber thieves.
The problem is compounded by the lack of segregation of data that exists within the industry. For example, a hotel may operate separately than the restaurants housed on the property, but in far too many cases, the third party vendor systems are linked, allowing for a smoother transaction for guests, such as charging the restaurant tab to the guest’s hotel stay.
Therefore, a breach of a hospitality company can have far-reaching effects. Third party systems are particularly vulnerable, potentially threatening not only the vendor’s data, but the data of its customers, many of whom are large hotel and hospitality chains. Given all the individuals and companies involved, this kind of situation can produce a domino effect that can be felt well beyond the initial entity that was breached. In one notable breach in 2017, thieves gained access to a third party reservation system vendor, exposing payment and customer information. The system is used by over 32,000 hotels and lodging entities.
Hotels
By far one of the most vulnerable segments of the hospitality industry – and most targeted for point-of-sale intrusions – are accommodations. According to a , hotels account for 92 percent of all point-of-sale intrusions.
Hotels tend to be more vulnerable than other segments of the hospitality industry because of the number of touch points that hotel marketing processes attempt to establish with their customers. Customers make online reservations, sign up for loyalty programs that link to their cards, present payment cards for the front desk to make an imprint of, and purchase meals onsite.
For hotels offering a wide array of guest services, the threat is multiplied exponentially. Due to the interconnectedness of other business entities within a hotel – shops, restaurants, dry cleaning services, business centers, and more – breaches can spread quickly across the enterprise and be complex and costly to remediate.
The costs of these breaches are mounting. Six or even seven figure settlement costs are not uncommon. A fast-food restaurant had millions of payment card records for customers stolen and being offered for sale on the internet. The four-year average cost per breach in the hospitality industry is .
