Why the Hospitality Industry Is More Exposed to Phishing Than It Thinks

Abstract bokeh photography showing a cluster of glowing light artifacts shaped like mail envelope icons in white, blue, and orange against a dark background.

by

The Hotel Blueprint

High turnover and AI are turning hotel staff into cyber targets. Discover why hospitality phishing is an operational design flaw, not a training issue.

1. The OTA Inbox as an Entry Point

Phishing and social engineering attacks targeting hotel staff have moved, in the space of two years, from opportunistic to industrialised. Beginning in December 2024, Microsoft Threat Intelligence identified and documented an active campaign โ€” tracked as Storm-1865 โ€” in which organised threat actors impersonated Booking.com across North America, Oceania, South and Southeast Asia, and Europe, using a technique called ClickFix to deliver credential-stealing malware. The campaign was confirmed still active as of October 2025, having been updated to deploy a more capable malware family known as PureRAT.

ClickFix works by exploiting the instinct hotels have trained into their customer-facing staff: resolve the issue quickly, before it affects the guest. The phishing emails varied in content โ€” a negative guest review requiring urgent response, a prospective guest inquiry, an account verification request, a promotional opportunity โ€” all using the routine language of daily hotel operations. Each email directed recipients to a convincing fake Booking.com page that prompted them to run a series of commands to “complete verification.” The commands installed malware. The objective was to steal extranet credentials for Booking.com or Expedia, either for resale on criminal forums or for use in downstream fraud against the hotel’s own guests.

The commercial consequence is direct and layered. Compromised OTA extranet credentials expose pricing controls, rate parity settings, inventory allocation, and guest contact data โ€” all in a single access event. Once inside an extranet account, an attacker can alter rates, cancel reservations, or send fraudulent payment requests to guests using the hotel’s verified sender profile. The resulting reputational damage โ€” guests receiving scam communications that appear to originate from a known brand โ€” does not appear on a single P&L line, but it erodes direct booking intent, loyalty programme trust, and repeat purchase rates over time.

One development worth tracking is the degree to which this has become a structured criminal industry rather than an opportunistic one. Threat actors behind the Booking.com extranet campaigns have been procuring hotel administrator credentials from criminal forums, in some cases offering traffers โ€” specialists who authenticate stolen credentials via proxy to verify they remain live โ€” fees as low as $40 per verified access. The people targeting hotel staff have mapped hotel operations. The question is whether hotel operators have responded at the same level of structural seriousness.

2. What 74% Annual Turnover Does to a Security Architecture

The accommodation sector’s labour model is not a temporary condition. The U.S. Bureau of Labor Statistics Job Openings and Labor Turnover Survey recorded a monthly quit rate for accommodation and food services of 4.3% in March 2026 โ€” nearly double the private-sector average of 2.2%, implying annual turnover of approximately 74%. Global hospitality labour patterns are directionally consistent: seasonal operations, shift-based scheduling, and constrained career progression produce structural churn across markets that is not a function of management quality but of industry design.

The security consequence is straightforward and consistently underweighted in operational planning. Any cybersecurity awareness delivered at onboarding decays as the employee population cycles. A hotel with 74% annual turnover replaces the majority of its trained workforce within twelve months, resetting the exposure clock with every new hire. The reservations coordinator who joined six weeks ago and has not yet completed the annual security review โ€” if one exists โ€” is precisely the profile that organised social engineering campaigns target.

This is not a theoretical vulnerability. KnowBe4’s 2025 Phishing by Industry Benchmarking Report, which analysed 67.7 million simulated phishing tests across 14.5 million users in over 62,000 organisations globally, found that roughly one in three employees clicks on a simulated phishing link before receiving any security awareness training, based on a global baseline phish-prone percentage of 33.1%. In large hospitality enterprises that sustained twelve months of continuous training, that rate fell by 93% to 2.4% โ€” a result that demonstrates training works when applied consistently and over time. The operative constraint in the hospitality context is both words: consistently, and over time.

The access architecture makes this worse. In most hotel technology stacks, a front-desk agent’s login to the property management system, the OTA extranet, or the central reservations platform carries the same access rights as a five-year employee in the same role. The system does not distinguish between the person in week two and the person in year five. The training gap and the access privilege are structurally decoupled โ€” which means the person most likely to click on a phishing link has, in many properties, the same level of system access as the person least likely to.

Some larger operators have begun addressing this by moving security awareness training into the operational onboarding cycle โ€” embedding credential hygiene and phishing recognition into the first two weeks of employment, before the new hire’s first live exposure to OTA communications โ€” rather than treating it as a standalone annual requirement. Whether this is sufficient against AI-generated social engineering at scale is an open question. What it does accomplish is closing the window of maximum exposure that currently exists between hire date and first security touchpoint.

3. The Helpdesk Call That Closed a Casino Hotel for Ten Days

In September 2023, a member of the threat actor group Scattered Spider called MGM Resorts’ IT helpdesk, spent approximately ten minutes on the phone impersonating an employee found on LinkedIn, and used the resulting access to reach MGM’s Okta single sign-on environment. From there, the group moved laterally through MGM’s systems using legitimate credentials. The operational consequences included slot machines going offline, digital room keys failing, and reservation systems shutting down across multiple properties. Total losses exceeded $100 million. In January 2025, MGM agreed to a $45 million settlement with affected customers.

This case has been reported extensively, but it has not been fully absorbed as an operational design lesson. The entry point was not a software vulnerability. It was a helpdesk reset process that had been architected to accommodate a high-turnover workforce: because hotel employees regularly rotate devices, forget credentials, and lose access, the verification workflow for a password reset was knowledge-based โ€” name, title, publicly available professional details. A caller with a LinkedIn profile and ten minutes of preparation could pass it.

The same design is in place, largely unchanged, across most multi-property hotel companies today. The verification methodology for a credential reset in a high-turnover environment tends toward the accessible rather than the rigorous โ€” because rigour creates friction, and friction in a shift-change environment creates operational complaints. That pressure is legitimate. It also means the helpdesk is, at most hotel groups, a social engineering entry point that training alone cannot close.

The P&L impact of a successful helpdesk social engineering attack is not limited to breach response costs. MGM’s revenue loss during the ten-day disruption ran at approximately $8.4 million per day. For a hotel without MGM’s recovery infrastructure, an equivalent proportional outage during peak occupancy โ€” the period when attackers specifically choose to strike, knowing operational pressure will be highest โ€” could be severe. Caesars Entertainment, targeted by the same group in the same period, paid a ransom of approximately $15 million to avoid a similar disruption.

Several operators are now implementing out-of-band verification for all identity reset requests: a secondary confirmation via a pre-registered phone number or a separate internal channel that a caller cannot have compromised through the same social engineering pathway. This adds friction to a routine process. More importantly, it relocates the security decision from the individual employee’s judgment โ€” which is what the attacker is manipulating โ€” to a process design that the attacker cannot influence.

4. The Vendor Chain: Liability That Hotels Do Not Control

Hotels do not operate in isolation. A full-service property typically connects its property management system to a channel manager, multiple OTA extranets, a central reservations system, a loyalty platform, a point-of-sale vendor, and several additional SaaS tools for housekeeping, maintenance, and revenue management. Each connection is a potential access point. Each vendor’s employee is a potential target.

The Verizon 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled year-over-year, now accounting for 30% of all confirmed breaches across the dataset. In hospitality, that figure has specific operational weight.

Between July and October 2024, threat actors gained access to Otelier โ€” a hotel management platform serving over 10,000 hotels globally โ€” through an employee’s login credentials stolen via infostealer malware. The attackers exfiltrated approximately 7.8 terabytes of data from Otelier’s Amazon AWS S3 environment, including hotel shift audits, accounting records, and guest details from Marriott, Hilton, Hyatt, and Wyndham properties. Have I Been Pwned confirmed 437,000 unique customer email addresses in the stolen dataset, alongside names, physical addresses, phone numbers, booking records, and partial payment data. Marriott suspended automated services with Otelier while the investigation proceeded.

The initial point of compromise was a single Otelier employee’s device. The credential was stolen by the same class of commodity infostealer malware that the Storm-1865 campaign deploys against hotel staff directly. The attack vector is identical; the target is simply one step removed from the hotel brand.

The legal exposure is not. Under GDPR and equivalent frameworks in force across Asia-Pacific, Latin America, and the Middle East, the hotel bears regulatory liability for guest data regardless of where in the vendor chain the breach occurred. A hotel that took no exploitable action itself โ€” and had no visibility into its vendor’s credential management practices โ€” can still face regulatory penalties and civil claims from affected guests. The Identity Theft Resource Center documented supply chain breaches tripling in Q1 2024 compared to Q1 2023. That trajectory has not reversed.

What some enterprise operators are beginning to require is contractual SOC 2 Type II audit evidence from technology vendors before integration โ€” a standard borrowed from enterprise software procurement that is still far from universal in hospitality, particularly among independent properties and management companies working with regional technology stacks. The gap between vendor risk management practice at large branded operators and at the rest of the market is currently material. The enforcement mechanism that will close it is more likely to be regulatory action following a high-profile breach than voluntary adoption.

5. The Email Volume Problem That Training Cannot Solve

Hotels communicate primarily through email. That is not a technology preference โ€” it is the architecture of third-party relationships across the industry. OTAs send booking notifications by email. Suppliers invoice by email. Guests communicate pre-arrival by email. Revenue management teams circulate rate parity alerts by email. A reservations coordinator or front-desk agent at a busy property may process dozens of external email communications in a single shift, a significant proportion of them from platforms whose addresses are familiar and trusted by design.

This creates a structural problem that has no training solution. The attacker targeting hotel staff does not need to craft an unusual message. They need to craft a message indistinguishable from the forty other emails the recipient is already processing that shift. Mimecast’s Threat Research Team identified a separate campaign distributing emails with urgent, business-critical subject lines โ€” tracking alerts, system updates, booking confirmations, partner notifications โ€” and noted that whoever designed it had a sophisticated understanding of hospitality workflows. That assessment is now common across threat intelligence publications covering the sector.

IBM’s Cost of a Data Breach Report 2025 identified phishing as the most common initial attack vector across 600 organisations studied globally between March 2024 and February 2025, involved in 16% of all breaches and associated with an average breach cost of $4.8 million per incident. For hospitality specifically, the average cost of a data breach rose from $3.62 million in 2023 to $3.86 million in 2024 โ€” one of the few sectors where costs increased even as the global average fell, according to IBM’s 2025 analysis. The upward movement reflects both the growing data value of hotel guest records and the growing precision with which attackers target the industry’s operational workflows.

The volume problem is structurally resistant to a behavioural solution because the commercial incentive in hotel operations runs in the opposite direction to caution. A reservations agent who pauses to verify every external communication slows down booking confirmations and guest inquiry responses โ€” activities directly tied to conversion and revenue capture. Speed is rewarded. Scrutiny creates friction. These pressures are in direct conflict, and the conflict is embedded in the role design, not in the individual employee’s judgment.

Some operators have begun addressing this at the process level by implementing protocols that route any communication requesting a credential action, a financial approval, or system access through an out-of-band verification step, regardless of how legitimate the originating message appears. This removes the decision from the individual employee and places it in a process that an attacker cannot manipulate through email alone. It also, critically, removes the implied culpability from the employee โ€” which matters in high-turnover environments where individual accountability for security outcomes is particularly difficult to enforce.

6. AI and the End of the Recognisable Phishing Email

For most of the history of phishing defence, pattern recognition was the primary detection mechanism: look for grammatical errors, unfamiliar sender domains, generic salutations, implausible urgency. That defence has been substantially compromised. IBM research indicates that generative AI can be used to craft a convincing phishing message in approximately five minutes, and that AI-powered phishing campaigns achieve a 42% higher success rate than conventional email-only attacks.

The threat actor group TA558, which has targeted hospitality for years, was documented in 2025 using AI-generated scripts to launch phishing campaigns against Spanish- and Portuguese-speaking hotel staff to steal credit card data โ€” a development cited by Pam Lindemoen, Chief Security Officer of the Retail & Hospitality Information Sharing and Analysis Center, in her February 2026 assessment of emerging hotel cybersecurity threats. The significance is not only that the campaigns were AI-generated, but that language barriers โ€” which previously provided some friction against international phishing operations โ€” have been removed. A threat actor based anywhere can now produce operationally fluent, grammatically accurate phishing emails in any language, at volume, targeting any hospitality market.

The more operationally specific risk is internal impersonation at the property level. An attacker with access to a hotel’s public communications โ€” its website, OTA profiles, social media, and any internal data obtained through a prior phishing event โ€” can generate a message in the register of that property’s actual communications. The general manager requesting urgent wire transfer approval during a peak-occupancy weekend, the DOSM forwarding an OTA partner request requiring immediate rate action โ€” these scenarios are no longer difficult to execute for a threat actor with AI tooling and basic reconnaissance. The deepfake variant โ€” a voice message convincingly imitating a known colleague โ€” has already been documented outside hospitality in a 2024 incident in which a finance employee authorized a substantial fraudulent transfer after receiving a fabricated voice call. Hotels share the structural conditions that made that attack possible: authorization processes that rely on recognizing a known voice, conducted under time pressure, without secondary verification.

Secure email gateways, AI-powered link detection, and domain authentication protocols (SPF, DKIM, DMARC) buy time and reduce volume. They do not eliminate the human decision point. The current operational debate among larger operators is whether the human decision point can be designed out of the most high-risk authorization workflows โ€” specifically financial approvals and credential changes โ€” before AI-generated social engineering makes the human link the definitive weak point in every attack chain.

7. An Operational Design Problem Misclassified as a Training Deficit

The consistent misclassification of social engineering exposure as an HR and training issue has a traceable origin: attacks arrive through human action, and training demonstrably reduces susceptibility. Both of those facts are true. They do not make the problem a training problem.

The conditions that create hospitality’s disproportionate exposure are operational in nature. A 74% annual turnover rate means the training-to-exposure timeline is structurally misaligned with the employment cycle: the workforce most likely to receive a social engineering attempt is, at any given moment, substantially composed of people who have not yet completed a full training cycle. Access architecture that does not vary with tenure means a new hire in week two carries the same system privileges as a five-year employee. Shift handoffs create verification gaps that attackers have learned to time their approaches around. A third-party communication volume too high to impose blanket scepticism on makes the OTA email channel a permanently exploitable entry point.

The number of hotel chief information security officers reporting directly to senior business executives jumped from 7% in 2024 to 19% in 2025, according to the RH-ISAC 2025 Benchmark Report โ€” a structural shift that brings security accountability closer to operations leadership. That proximity matters because the design changes that reduce social engineering exposure are not IT decisions. They are operations decisions: how access rights are scoped and reviewed, how shift handoffs are structured, how credential reset requests are verified, which communication workflows are treated as high-risk by default. An IT director who owns the firewall cannot make those changes. An operations director who owns the workflow can.

The evidence from 2024 and 2025 consistently points to the same conclusion. Technical controls and staff training both have a measurable role. But the hospitality industry’s structural exposure to social engineering โ€” its labour model, vendor dependencies, communication architecture, and access design โ€” is not a training deficit. It is how the business is built. Until operators treat it as an operational design problem, the breach trajectory will continue in one direction.

Data Source

Most read

OUR PUBLICATIONS

Also to discover