AI gives hotel industry advantage—and opens the door to more threats

Hotel, motel, Holiday Inn—if AI starts acting up, then you call IT in.

As the hospitality industry integrates automation and generative AI into its approach to guest services, some experts worry that the threat surface might be expanding. Pam Lindemoen, CSO of the Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC), told IT Brew that hackers will always aim to make systems do things they’re not supposed to.

“If you think about how something is created, its intended use, hackers go in to try to manipulate that use—manipulate all the controls that we in our industry are putting in place to protect the user,” Lindemoen said.

Break of dawn. Hyatt Hotels CISO Benjamin Vaughn told IT Brew this month that the scope of guest information available in hotel systems makes the industry a valuable target for attackers. Whether it’s travel points or other types of data, hackers are looking for valuable information they can use.

“Criminals want to steal your points,” Vaughn said. “Other more advanced threat actors are interested in when you took a flight.”

Successful attacks have a cost. In late January, MGM Resorts International paid $45 million to settle a class-action lawsuit brought over breaches to customer data in 2019 and 2023.

Sure shot. For Lindemoen, the threat requires that hospitality-focused cybersecurity professionals take proactive steps to ensure that the AI threat surface doesn’t present the kind of problems that can lead to catastrophe. Basic security processes like end-to-end encryption, better password management protocols, network segmentation, patching, and other methodologies can be effective and helpful, she said.

“If you have a data-loss prevention and a data standard that you’re complying with for all of your other technology, layering on AI controls, in theory, should be very helpful,” Lindemoen said. “You’re already managing data-loss prevention in other areas, so you just apply it to those new technologies.”

Ultimately, it’s a delicate dance for the hospitality industry, which “has to balance convenience versus privacy,” as Lindemoen put it. And with the introduction of AI into the process, that balance has another factor to consider.

“It’s a constant battle to ensure that these tools are being leveraged to make that seamless transaction and experience for the hospitality that we’re providing, through hotels and bookings…without divulging information that it shouldn’t,” Lindemoen said. “It’s very complicated.”