Hotel Cyber Security in 2026: Why Preparedness Is Now a Commercial Priority

In more than 25 years working in technology, I have never seen a security environment as challenging as the one hotels face today.

I don’t say that lightly. I’ve lived through the arrival of the internet, online booking, the rise of the OTAs, the move to cloud systems and the shift to mobile. Each brought new risks, and each time the industry adapted. What’s happening now feels different. Cyber crime is becoming more frequent, more sophisticated and, crucially, far harder for ordinary people to recognise. And the reason, more than any other, is artificial intelligence.

This article is a situational update for hotel owners and operators who aren’t technical people and don’t want to become technical people. It sets out what the numbers are telling us, why hotels are firmly in the firing line, why I believe this will get worse before it gets better, and the handful of areas where a little discipline makes an enormous difference.

What the Numbers Are Telling Us

The major security reports published this year all point in the same direction.

CrowdStrike’s 2026 Global Threat Report found that activity by attackers using AI rose by 89% in 2025 compared with the year before. The average time it took criminals to move from their first foothold in an organisation to other systems fell to 29 minutes. And 82% of the attacks it detected didn’t use malware at all. The criminals simply logged in with stolen or abused credentials, behaving like legitimate users.

Verizon’s 2026 Data Breach Investigations Report, one of the most respected annual studies in the field, analysed more than 22,000 confirmed data breaches, nearly double the previous year’s figure. For the first time in the report’s history, exploiting weaknesses in software overtook stolen passwords as the most common way in, accounting for 31% of breaches. At the same time, businesses are getting slower at fixing those weaknesses, with the median time to fully patch rising to 43 days. Nearly half of breaches involved a third party, such as a supplier or software provider.

Email remains a favourite route in. Hornetsecurity, which analyses around 72 billion emails a year, recorded a 131% rise in emails carrying malware in 2025.

And this isn’t a problem happening somewhere else. According to SCB EIC, Thais lost around ฿32 billion to technology-related crime in 2025, following around ฿39 billion in 2024. More than 190,000 cases were reported in the first seven months of 2026 alone.

Then, last week, came PHP2Shell: two critical flaws in the programming language behind roughly 70% of the world’s websites, including most hotel websites. They had existed for more than a decade, were found with the help of AI, and were being exploited before the fixes were even published. I’ve written about what it means for hotel websites separately, but as a snapshot of where we are, it could hardly be clearer.

Why Hotels Are in the Firing Line

There’s a common assumption that cyber criminals are mainly interested in banks, governments and large corporations. That assumption is understandable, and it’s wrong.

Hotels are attractive targets for a simple reason: they handle exactly what criminals want, every single day. Card payments. Passport details. Names, addresses, phone numbers and travel dates. Supplier payments and payroll. And they do it around the clock, often with a small team and a night shift that’s stretched thin.

Hotels also tend to run on a web of connected systems: a PMS (property management system), a channel manager, a booking engine, several OTA extranets, a website, a payment gateway, accounting software and a handful of messaging apps. Each connection is useful. Each is also a door. And as Verizon’s figures show, a growing share of breaches now come through a third party rather than the business itself.

Add seasonal staff turnover, shared logins, personal phones used for work and the general pace of hotel operations, and you have an environment where an attacker only needs one person to have one bad moment.

We’ve already seen what that looks like this year. Criminals have been tricking hotel reservations staff into handing over access to their Booking.com extranets, then using real reservation details to send fake payment requests to guests. In Japan alone, more than 40 hotel groups and properties posted public warnings, and one operator disclosed that its revenue payouts had been redirected to a criminal’s bank account.

Why I Believe This Will Get Worse

My view, and I hold it firmly, is that this will become more prevalent as AI becomes more powerful. Not because AI is inherently dangerous, but because it changes the economics of crime.

Three things are happening at once.

Finding weaknesses is getting faster. PHP2Shell is a perfect example. Flaws that sat unnoticed for over ten years were found in weeks with AI assistance. Responsible researchers found these ones. Others will be found by people with very different intentions, and the window between discovery and attack is shrinking from months to days.

Deception is getting cheaper and more convincing. For years, poor spelling and clumsy grammar gave scams away. Today, AI can produce a fluent, personalised message in any language in seconds, and can imitate a familiar voice from a short recording. A message that looks professional and comes from a familiar name is no longer evidence that it’s genuine.

Attacks are getting easier to scale. What once took a skilled criminal hours can now be automated across thousands of targets at once. Small businesses that were never worth an attacker’s personal attention are now swept up by automated tools that don’t care who you are.

The same technology is, of course, improving defences too. Security tools are getting better at spotting unusual behaviour, and we’re investing heavily in that ourselves. But technology alone won’t close the gap, because so many attacks now succeed by persuading a person rather than breaking a system.

Preparedness, not panic, is the right response.

Security Is a Commercial Issue, Not an IT Issue

One of the things I most want hotel owners to take from this is that cyber security isn’t something to hand to whoever fixes the printer.

Think about what a serious incident actually costs a hotel. Direct financial loss from fraudulent transfers or redirected payouts. Guests who were defrauded in your name and who leave reviews accordingly. A website that Google flags as dangerous, taking your direct booking channel offline in peak season. Days of disrupted operations while systems are restored. Potential obligations under Thailand’s Personal Data Protection Act if guest data is exposed. And the slow, expensive work of rebuilding trust.

For hotels that have invested years in growing direct bookings and their own guest relationships, that last cost is the one that hurts most. Guest trust takes years to build and a single incident to damage.

That’s why I’d encourage owners and general managers to treat security the way they treat fire safety or food hygiene. You don’t need to be an expert. You need to know the risks, set clear rules, make sure the right people are responsible, and check periodically that it’s all actually happening.

The Five Areas Every Hotel Should Get Right

You don’t need a large budget to reduce your risk substantially. In my experience, the hotels that come through incidents well are those that get a small number of basics right, consistently.

1. Card details and guest payments. Never ask guests to send full card details or security codes by email, LINE or WhatsApp. Never store card details in spreadsheets, documents or inboxes. Use secure payment links from your booking engine, PMS or payment provider instead, and treat unusual payment or refund requests with suspicion.
2. Payment requests and bank detail changes. Criminals regularly impersonate owners, managers, suppliers and partners. Any request to change bank details, make an urgent transfer or send a refund somewhere new should be verified by phone, on a number you already hold, before any money moves. Larger transfers should need two people to approve them.
3. AI impersonation. Assume that any message, voice note or call can be faked. Agree a simple code word between owners and finance staff for unusual payment requests, and make it absolutely clear to your team that checking an instruction will never get them into trouble.
4. Computers and accounts. Keep computers and software updated. Use strong, unique passwords and turn on two-factor authentication on email, OTA extranets, your PMS and banking. Give each member of staff their own login, and remove access the day someone leaves. Know who looks after your website and server, and make sure they patch quickly.
5. Acting quickly when something goes wrong. If you suspect fraud, unauthorised access or an accidental disclosure of data, contact your bank, your payment provider, your software providers and your technology partner immediately. The sooner an incident is reported, the more can be done to limit the damage. Have a one-page plan with the right phone numbers printed before you need it.

I’ve written separate, more detailed articles on PHP2Shell and hotel websites, the Booking.com reservation hijack, payment fraud and AI impersonation, and what to do in the first hour of an incident. Each is written for owners and operators rather than IT specialists.

A Shared Responsibility

At The Percentage Company, we take the security of our systems and our clients’ information very seriously, and we’re investing heavily in it. But I’d be doing our clients a disservice if I suggested that technology providers alone can keep a hotel safe.

Security also depends on the decisions people make every day: whether a reservations agent clicks a link, whether an accountant calls a supplier back, whether a manager removes a former employee’s login. Those decisions sit with the hotel. The best outcomes come when providers and hotel teams treat security as a shared responsibility.

Stop, Check, Verify

If there’s one message I’d like every hotel team to remember, it’s this: stop, check and verify before sharing sensitive information, approving a payment or clicking on something unexpected. A few seconds of checking can make all the difference.

The threat environment has changed, and it will keep changing as AI develops. The hotels that come through it well won’t necessarily be the ones with the biggest budgets. They’ll be the ones that prepared.

At The Percentage Company, our work sits at the intersection of hotel technology, distribution and digital marketing, and the security of those systems is part of the job. If you’d like to review how secure your website, booking systems and payment processes really are, or you think your property may already be under attack, we’d be glad to help you work through it.