Luxury hotel staff work in some of the world’s most stunning locations. They maintain immaculate properties and provide outstanding service. However, behind the warm greeting, they contend with the same operational demands and vulnerabilities as hotel teams everywhere, only more intensely.
The latest incident began with a familiar pattern. On Monday, the General Manager contacted HR and IT after Finance identified several refunds issued to guests who never requested them. The payments had gone to fraudulent accounts, and the evidence pointed to another cyber breach.
As the investigation progressed, IT confirmed that attackers had targeted the hotel again. This time the entry point was a phishing email designed to look exactly like a booking request, the type of message the hotel receives every day. In most industries, an email from a stranger is a warning sign. In hotels, that is part of the job. A new booking starts with an email from someone we have never met.
We suspect a colleague opened the email and clicked the link, unknowingly giving the attackers access to the reservations shared inbox. For two weeks, it went unnoticed.
During that time, the attackers went in and out of the inbox, copying previous refund requests. They then sent several refund requests to the manager, and because they looked exactly like the real thing, the manager approved them.
This incident cannot be classed as simple user error, nor separated from the fast-paced and demanding environment hotel employees work in daily.
Why Luxury Hotels Collect So Much Personal Data
Luxury hotels operate in a world where guest expectations are extravagant, personalised and almost limitless. Service is paramount. As one General Manager (GM) once told me, the only real boundary is illegality. Guest requests range from the ordinary to the extraordinary. Midnight in-room massages, specific wellness rituals and bespoke gastronomic experiences are routine. A colleague once flew more than 1,300 miles to collect a guest’s preferred toiletry bag. Another guest requested honey and goat’s milk for daily baths. These requests are not unusually eccentric; they are normal and frequent.
Continue reading Phishing at the Front Desk: Usable Security in Luxury Hotels