Travel's stolen data problem: Why cybercriminals want booking details

Source

PhocusWire: Travel's stolen data problem: Why cybercriminals want booking details

What It Says

The travel industry is increasingly targeted by cybercriminals who value booking details over credit card numbers. Recent security incidents involving major travel entities like Booking.com, Manchester Airports Group (MAG), and BCD Travel demonstrate how hackers use non-financial data—such as guest names, stay dates, hotel locations, and vehicle registrations—to orchestrate highly convincing, targeted phishing and impersonation scams.

The core vulnerability lies in the travel ecosystem's fragmented structure. A single trip requires data sharing across multiple independent platforms, including airlines, property management systems, online travel agencies (OTAs), and ground transport providers. This interconnectedness creates numerous entry points for bad actors to intercept data.

Why It Matters

For short-term rental (STR) operators and technology vendors, this shift in cybercriminal strategy is a major threat. While payment gateways are heavily fortified, guest reservation details are often treated with lower security priority.

If a property management system (PMS), channel manager, or guest communication tool is breached, hackers can use upcoming reservation details to contact guests directly. By posing as the host or booking platform, scammers can easily trick guests into making fraudulent payments or revealing sensitive information outside of secure channels. This directly damages host reputation, guest trust, and platform credibility.

Useful Signals

Targeted Phishing: Criminals use specific booking details (e.g., check-in dates and property names) to send highly personalized, believable messages to guests.
Multi-Vendor Risk: Data is only as secure as the weakest link in the booking chain, which often includes third-party integrations, smart lock providers, and guest screening tools.
Impersonation Scams: Hackers leverage stolen business contacts and booking details to impersonate hosts, demanding "urgent" payment verifications or security deposits.

STR Tech Report Take

The STR industry must shift its cybersecurity focus from protecting credit cards to securing the entire reservation data pipeline. Technology vendors should implement stricter access controls, end-to-end encryption for guest details, and multi-factor authentication (MFA) across all operator accounts. Operators must also educate guests to only communicate and transact through official, verified platform channels to mitigate the risk of highly targeted social engineering attacks.

Original Source