15/06/2015
Cyber criminals are getting increasingly smarter and finding sophisticated new ways to steal customers’ data from hotel websites, front desks and sites, warns PwC. These cyber risks are influenced by the growing strategic importance of technology and increased value of intangible assets, such as guest information, created and managed on hotel technology platforms.
Over the years, hackers have been infiltrating hotel networks and have infected hotel-owned computers and guest computers with the aim of stealing personal and confidential information. PwC’s hospitality and gaming industry warns that hotels offer ample opportunity for cyberattacks in the wake of increasing credit card transactions at check-in, as well as at hotel bars, restaurants and shops. “Each charge made at a spa, gift shop, bar or restaurant during the course of a guest’s stay is another opportunity for cyber theft,” says Nikki Forster, hospitality industry leader for PwC, Southern Africa. “For business travellers, access to fast and low-cost internet is a must have, but these Wi-Fi connections are not always secure. This is a security gap that cyber criminals are making use of.”
Hotel networks have been attacked using mathematical techniques and crypto-analytical offensive capabilities. “This is usually done by hackers waiting for guests to check in and log on to the hotel Wi-Fi by usually submitting their room number and surname,” explains Veneta Eftychis, senior manager of PwC Hospitality and Gaming Industry. “Thereafter the hotel guest gets tricked into downloading and installing a so-called backdoor file, which pretends to be an update for legitimate software.”
The unsuspecting guest downloads a ‘welcome package’ only to infect his or her machine with spying software. Once on a network, the backdoor may be used further to download more advanced tools such as an advanced key logger. Downloaded software may also look for Twitter, Facebook and Google login credentials, as well as other private information.
“There are a number of safeguards that guests can put in place in order to mitigate the risks of attack,” Eftychis says. These include, amongst others, updating antivirus software before leaving home; avoiding updating software or clicking files when not on trusted networks; and using a virtual private network (VPN) to establish an encrypted communication channel when accessing public or semi-public Wi-Fi.
“The impact of a cyberattack can be far-reaching and devastating,” says Eftychis. Firstly, there is a financial impact when any type of computer security breach occurs. Costs can include forensic computer investigations to confirm the breach, and identify whose information has been put at risk. Other costs include credit or identity protection services for affected individuals, and crisis management and PR specialists to help mitigate the potential fallout from breach event.
Secondly, breach of cyber security can also impact a company’s performance. Eftychis points out, recent breaches have had an impact on customer loyalty and store traffic, which has the potential to have a lasting impact on long-term profitability and share value.
Security breaches can also carry personal risk for hotel executives and board members. Attacks are drawing increased scrutiny from government regulators worldwide who want to ensure directors and officers are taking necessary steps to prevent breaches.
“Unfortunately cybercriminals are becoming more sophisticated – to stem the tide hotels also need to stay proactive and put a strategy and incident response plan in place. As part of the plan, hotels should be aware of policies and processes relating to data breach, and educate staff on protocols,” concludes Eftychis.
(courtesy eTNW)
