Cybersecurity Is Now Part of the Guest Experience

A guest books a mountain getaway. Perhaps it is an anniversary, a long-awaited holiday, or a wedding weekend they have spent months planning.

Then a message arrives.

It contains their name, their reservation number, and their actual travel dates. It asks them to verify their payment information, with a warning that their booking will otherwise be cancelled.

The details are familiar. The request is urgent. Suddenly, something they were looking forward to becomes something they are worried about.

Over the past few days, I have been helping hospitality operators respond to precisely this situation.

The WebRezPro incident is the immediate prompt for this article. Its public status notice acknowledges reports of unauthorized WhatsApp messages relating to guest reservations, warns against sharing information or clicking the links, and says an investigation is underway. WRP Status

But the bigger question reaches beyond one software provider.

What does it mean to promise guests peace of mind when part of their experience depends on systems we do not directly control?

The risk does not stop at the front desk

I have certainly had my share of suspicious-email moments—the kind that end with a call to tech support and a sincere wish to put the computer back the way it was five minutes earlier.

Or perhaps that is just me.

That familiar picture of cybersecurity is still relevant: an unexpected attachment, a convincing message, a rushed decision. Microsoft has documented campaigns specifically targeting hospitality employees with messages impersonating Booking.com and delivering credential-stealing malware. Microsoft

But that is not the whole picture.

A property’s information can move between its reservation system, booking engine, distribution connections, payment provider, guest-messaging tools, and other services. Protecting the hotel’s own computers does not eliminate the risks introduced by those relationships. The Canadian Centre for Cyber Security explicitly warns that a vulnerable supplier can create exposure even for an organization with strong security of its own. Canadian Centre for Cyber Security

This is not a problem that began with generative AI.

In 2017, Sabre disclosed unauthorized access to certain payment-card information associated with a limited subset of hotel reservations processed through its SynXis reservation system. Some affected travel businesses did not themselves use or directly interact with that system. The exposure travelled through the booking network. Sabre

For an independent operator, that is an uncomfortable reality: a problem somewhere else can still arrive at your front desk.

And the guest is unlikely to begin by asking which technical component failed. They will ask whether their booking is safe, whether their information has been exposed, and what you are doing to help.

AI changes the speed, not the need for sound security

A recent example from outside hospitality makes that connected risk particularly clear.

Security researchers at Hacktron described using Claude to help develop an exploit affecting software used by OpenAI’s community forum. Combined with an OpenAI sign-in flaw, it enabled access to employee accounts and a demonstration involving an internal repository. The findings were reported, fixes followed, and OpenAI awarded a bounty for the OpenAI-side issue. This was not simply a chatbot being persuaded to ignore an instruction. Hacktron AI

The hospitality lesson is not that “even OpenAI was hacked, so nothing can be protected.”

It is that trusted services depend on other software, permissions, and connections—and those relationships deserve scrutiny.

The Canadian Cyber Centre warns that advanced AI can accelerate vulnerability discovery and enable more sophisticated, individualized phishing. It also encourages defenders to use AI to improve protection. The technology is strengthening capabilities on both sides, not handing attackers an automatic victory. Canadian Centre for Cyber Security

There is no evidence in the material reviewed for this article establishing that AI was used in the WebRezPro incident. The connection is the broader risk environment, not a claim about how this particular incident happened.

“No system is invulnerable” does not mean security is pointless

There is a dangerous leap between acknowledging that a system can be breached and concluding that every system is equally vulnerable.

Those are not the same thing.

The practical objective is to reduce the likelihood of compromise, limit what becomes accessible when something fails, detect problems promptly, and respond effectively. The Canadian Cyber Centre’s baseline guidance combines prevention with incident response and recovery for precisely that reason. Canadian Centre for Cyber Security

Software selection therefore matters enormously—but not because an operator can purchase a guarantee that nothing will ever go wrong.

The better questions concern how the provider protects information, restricts access, maintains its software, identifies suspicious activity, and supports customers when an incident occurs.

Nor would I treat a familiar brand as sufficient evidence of security, or a smaller provider as automatically unsafe. Those assumptions tell us little about the controls actually protecting the guest.

Potential exposure is shared across the industry. Security maturity is not necessarily equal.

Does this give online travel agencies an advantage?

It is a reasonable commercial question.

Could a guest feel more comfortable paying a recognizable travel platform than entering card information into an independent hotel’s booking process?

Possibly. But we need to separate three things: where the booking is made, who handles the payment, and where the reservation information goes.

For example, Payments by Booking.com can pay participating properties through a virtual credit card or bank transfer, depending on the property’s arrangements. That can separate the hotel’s payout from the guest’s personal card number. Expedia also distinguishes between online collection and “property collect,” where card details are provided to secure a booking and the property generally takes payment. An OTA booking does not describe one universal payment arrangement. Booking Partner

Direct bookings can also use payment integrations that send sensitive card information straight to a payment processor without passing through the hotel’s own servers. Stripe documents this approach, for example. The protection comes from the payment design and its implementation, not simply from the logo above the checkout button. Stripe Docs

More importantly, protecting a card number does not, by itself, protect a guest from reservation-based fraud.

Booking.com’s April 2026 disclosure illustrates the distinction. The company confirmed unauthorized access to some booking information, while stating that financial information had not been accessed from its systems. Reservation privacy and payment security are related, but they are not interchangeable. BleepingComputer

In the cases brought to me, the convincing part of the scam was the knowledge of the real reservation. The attacker was asking the guest to provide financial information; possession of the original payment card was not necessary to make that request credible.

So I would not frame this as “book direct versus book safely.”

The more useful question is:

How do we make the legitimate booking and payment journey clear enough that guests can recognize and verify it?

A familiar platform may gain an advantage when a guest feels uncertain. That is a plausible behavioural response, not evidence that this incident has already shifted booking share. Independent properties should take the question seriously without assuming the outcome.

What I would add to the operator’s agenda

I am approaching this as a hospitality operator and strategist, not as a forensic investigator. Technical controls need qualified expertise. But several decisions belong firmly in the ownership and management conversation.

Ask harder questions before signing a software agreement.
Who can access guest information? Which other providers receive it? What independent security assessment is available? How quickly are vulnerabilities addressed? What will the provider tell us after an incident, and when? The Canadian Cyber Centre recommends evaluating suppliers’ data handling, security practices, retention, and notification commitments, not simply their features and price. Canadian Centre for Cyber Security

Reduce unnecessary information and access.
Use payment arrangements that minimize the need to handle raw card details. Give staff and connected systems only the access required for their roles. Use phishing-resistant multifactor authentication where supported. These measures address different risks: stronger staff authentication is valuable, but it cannot substitute for fixing a vulnerability inside a supplier’s platform. Stripe Docs

Make payment communication predictable.
I would want every guest to know when payment is due, how a legitimate request will arrive, and how to verify anything unexpected through an independently obtained contact number. The confirmation should do more than confirm dates. It should establish what the real process looks like. That gives staff and guests something concrete to refer back to when a contradictory message arrives.

Test whether you can actually reach affected guests.
One surprisingly practical issue in this response has been assembling a reliable contact list.

That belongs in software evaluation.

Can your team identify the relevant reservations and contact details quickly? Can it distinguish current guests, future arrivals, and any other records within the affected scope? Can it remove duplicate recipients and spot missing contact information? Can it communicate through a channel that has been checked independently of the affected system?

A reporting feature can look like an administrative convenience until it becomes part of your incident response.

This is not an argument for downloading the entire guest database onto someone’s laptop. It is an argument for a tested, access-controlled process that provides the minimum information needed when it matters.

Rehearse the response before the next difficult morning.
Decide who coordinates with the provider, who obtains technical and privacy advice, who briefs the team, and who communicates with guests. Preserve relevant evidence and distinguish what is known from what remains under investigation. An incident-response plan should sit alongside business continuity planning, not exist only in the IT provider’s head. Canadian Centre for Cyber Security

Will guests stop travelling, or change how they book?

I would be cautious about predicting a broad decline in travel from this incident.

The first questions to investigate are closer to the booking journey.

Are guests calling more often to verify messages? Are they hesitating at payment? Are they choosing a different channel because they recognize its checkout process? Are staff spending more time reassuring people who have already booked?

Those are measurable signals. They could affect conversion, distribution costs, and workload without necessarily changing the guest’s decision to take the trip.

I would track those signals before attributing a change in bookings to cybersecurity concerns. A change in channel mix alone does not explain why it happened.

For independent properties, the opportunity is not to claim that their systems are untouchable. It is to make the legitimate process understandable and the human support easy to reach.

Peace of mind begins before arrival

We spend considerable time designing the feeling of a stay: the welcome, the room, the breakfast, the quiet, the sense that someone has thought of the details.

A fraudulent message can intrude on that feeling long before the guest arrives.

The technical cause may sit with a provider. Investigating and repairing it may require specialists. But the guest relationship still needs someone who will take responsibility for helping.

We cannot credibly promise that nothing will ever go wrong.

We can build better systems, ask more of our partners, communicate honestly, and make sure guests are not left to navigate uncertainty alone.

We can outsource the software. We cannot outsource the guest’s confidence in us.

©2021

Peak Hospitality

Privacy Policy

Experience Led Hospitality Growth