Under Attack? What Hotels Should Do in the First Hour of a Cyber Incident

When something goes wrong with a hotel’s systems, the first hour usually decides how expensive the next six months will be.

I’ve seen it play out both ways. One property spots a fake payment request on a Saturday morning, makes three phone calls, and has the problem contained by lunchtime. Another notices something odd, decides to wait until the IT person is back on Monday, and spends the following weeks dealing with angry guests, a frozen bank account and a website flagged as dangerous by Google.

The difference is rarely technical skill. It’s knowing what to do, in what order, before panic sets in.

Why Speed Matters More Than Ever

Attackers move quickly once they’re inside. CrowdStrike’s 2026 Global Threat Report found that the average time for criminals to move from their first foothold to other systems fell to 29 minutes in 2025. The fastest case it recorded took 27 seconds. In one intrusion, data was being copied out within four minutes of the attacker getting in.

You won’t match those speeds, and you don’t need to. But it does mean that “let’s wait and see” is no longer a safe option. If you suspect something, treat it as real until you know it isn’t.

The Signs Worth Acting On

Most hotel incidents announce themselves in ordinary ways. A guest says they received a payment request you didn’t send. A supplier asks why their invoice was paid to a different account. Staff can’t log in to the extranet or the PMS (property management system, the software that runs your reservations and front desk). The website starts redirecting to strange pages. Files on a shared computer suddenly won’t open and a message demands payment. Your bank calls about a transfer nobody recognises.

Any of these is enough to start the steps below.

The First Hour, Step by Step

1. Isolate the affected computer, but don’t switch it off. Unplug its network cable and turn off its Wi-Fi. This stops the attacker using it to reach anything else. Leave it powered on if you can, because it may hold evidence that helps establish what happened. Don’t start deleting files or running clean-up tools you found online.
2. Secure your accounts from a different, clean device. If a computer may be compromised, anything you type on it may be visible to the attacker, including new passwords. Use another device to change passwords for email, the OTA extranets, your PMS, your channel manager and online banking. Turn on two-factor authentication wherever it’s available, and use the option to sign out all other sessions.
3. Call your bank and payment provider immediately if money is involved. This is the step where minutes genuinely matter. Banks can sometimes stop or recall a fraudulent transfer if they’re told quickly, and the chances fall sharply with every hour that passes. Ask them to flag the account and to check for any other unusual activity.
4. Tell the providers whose systems are involved. That usually means your PMS and booking engine provider, your website host, your channel manager and the partner support teams at Booking.com, Agoda or Expedia. They can lock accounts, check their own logs and tell you whether other properties are seeing the same thing. And tell us, if we look after any of your systems.
5. Write down what happened, as it happens. Note times, who noticed what, which messages arrived and what actions were taken. Take screenshots of suspicious emails, chats and payment requests before anything is deleted. This record matters for your bank, your insurer, the police and any specialist who helps you later.
6. Don’t pay a ransom on the spot. If you’re faced with ransomware (software that locks your files and demands payment to release them), the pressure to pay quickly is intense, and it’s designed to be. Payment doesn’t guarantee your data back. Verizon’s latest research found that only around 31% of ransomware victims paid. Take advice first.

After the First Hour

Once the immediate damage is contained, a few further steps need attention.

Report it. In Thailand, online fraud can be reported through the Royal Thai Police online reporting system, and the government’s Anti Online Scam Operation Centre runs the 1441 hotline. A police report is often required by banks and insurers.

Consider your legal obligations. If guests’ personal data may have been exposed, Thailand’s Personal Data Protection Act generally requires the business to notify the Personal Data Protection Committee within 72 hours of becoming aware of the breach, unless it’s unlikely to put anyone at risk. Where the risk to individuals is high, they may need to be told as well. I’m not a lawyer, and every situation is different, so take proper legal advice early. But don’t let the clock run out because nobody knew it had started.

Talk to your guests honestly. If guests have been targeted with fake payment requests, contact upcoming arrivals directly and tell them what to look out for. Guests forgive a hotel that warns them. They’re far less forgiving of one that stayed silent.

Find the way in. Changing passwords stops the immediate problem, but if you don’t know how the attacker got in, you can’t be sure they’ve gone. This is where a proper investigation, sometimes by a specialist forensic firm, earns its fee.

Prepare the One-Page Plan Now

The best time to work out what to do in an emergency is before you have one. Every hotel, whatever its size, should have a single sheet of paper, printed and kept somewhere obvious, that answers a few basic questions:

• who decides what happens, and who is their deputy if they’re unreachable?
• the phone numbers of your bank’s fraud team, your payment provider, your PMS provider, your website host and your OTA partner support
• who holds the admin logins for each system, and where are they kept securely?
• when were your backups last tested, and who can restore them?

It takes an afternoon to put together. It can save weeks.

If You Need Help Now

At The Percentage Company, we look after websites, booking engines and connected systems for hotels across Thailand, and we take the security of our systems and our clients’ information very seriously. If you think your property is under attack, or something simply doesn’t look right and need help, get in touch with us today.