Recently, news of cyber attacks targeting companies and organizations has been constant. As has already been reported, even large corporations that should have invested heavily in security have suffered data breaches, and we expect this trend to keep spreading.
We believe AI-driven attacks in particular are only just getting started. Convincing scam emails disguised as booking confirmations and fake websites are becoming automated and produced at scale, and the assumption that "a small property like ours won't be targeted" no longer holds. Hotels, lodges and tourism facilities handle a great deal of attractive information — guest names, contact details, passport information and payment details. Please prepare on the assumption that an attack will come, so that any damage is kept small.
Be careful when installing software
Many untrustworthy Windows apps and Chrome extensions are in circulation. Front desk and back-office PCs are often shared by several staff members, so please remind your team not to install anything carelessly, however useful it may look. If you are unsure, feel free to ask us.
Review how you handle guest personal information
Even if an intruder does get in, it is important to keep the information that can leak to a minimum.
- Do not keep files containing personal information — guest registers, passport copies and so on — in folders anyone can open (including shared drives). Limit access to the people who really need it.
- Do not collect personal information you don't need in the first place.
- Promptly delete personal information that is no longer needed, such as records past their legal retention period.
Please also check that accounts for seasonal staff who have left, and their access to shared folders, have not been left active.
Clean up accounts for services you no longer use
We have no way to prevent data leaking from external services such as booking sites and cloud services. We recommend deleting accounts for services you signed up for in the past but no longer use, where possible. Please also enable two-factor authentication on important accounts, such as your reservation system and OTA admin pages.
We can inspect and replace your network equipment
"It was set up years ago by former staff or a contractor, and nobody knows the admin password." "The person who configured it has left, so nobody knows what's inside." Situations like these are far from rare — and not only with routers and Wi-Fi equipment, but with phone systems and servers too, which keep running in that state. Older equipment often no longer receives security updates and can become an entry point for attackers. If your guest Wi-Fi and business network are not separated, we recommend reviewing this soon. We can survey, tidy up and replace your equipment — please get in touch.
If the worst happens
In the event of a cyber attack, initial response will be prioritized for customers on a monthly support contract. If damage is widespread, we expect requests to be concentrated, so we appreciate your understanding.
If nobody in your organization knows how your current network is set up, simply working out the situation can take a long time when something goes wrong. Trouble during high season has an especially large impact on your business. Knowing your environment day to day is the fastest route to recovery. We would be grateful if you would take this opportunity to consider a monthly support contract.