Cyber-Attacks Risk Management in the Hospitality Industry

Cyber-Attacks Risk Management in the Hospitality Industry

Call it the elephant in the room.  Call it the ticking time bomb.  However you call it, cyber-attacks cannot be avoided by burying your head in the sand, or by being “penny wise, pound foolish.” Cyberattacks cost businesses world-wide an estimated $315 billion over the past 12 months, reports Infosecurity Magazine (Sept. 24, Muncaster), citing new research from Grant Thornton International’s latest International Business Report. It’s not a matter of if but when your company will be a victim. Once your clients’ sensitive information, and your company’s financial data are breached, grave damages will be done, some beyond repair, such as loss of money, the amount of time, labor, and expertise you have to pay for to control damages if possible at all, loss of trust from future customers, and the irreversible damage to your business reputation.

All industries and services need to put cyber security as their top priority and adopt prevention approach rather than reaction to crises after breaches already take place and damages are done. Hospitality industry is no exception. Nonetheless, in spite of our best efforts and diligence, some cyber-attacks just can’t be prevented. What else can you do to protect your company and customers?

“Companies need to … plan for the consequences of a cyber-attack as part of a comprehensive risk management program”, said Tom Bullen, a risk management advisor at AETHOS Consulting Group and a partner at Premier Risk Management. On average, it costs US $190 per individual to notify customers that a breach has occurred and to offer them assistance to protect their identity going forward. If a major hotel company has their customer data compromised, that could mean that hundreds of thousands of customer could be affected – imagine the cost! Bullen suggests these steps to manage cyber-attack risks:

• Identify all the risks to which the company is exposed to.
• Quantify and prioritize each category of risk.
• Establish ways to mitigate these risks, including the appropriate insurance coverage as part of a comprehensive risk management strategy.
• Perform periodic reviews (at least annually) of changes in the company or its environment and adapt the program accordingly.

Both Board of Directors and the executive leadership of a company must be updated with the potential risks, AND risk-mitigation plans. It’s not just an IT issue, since the entire organization’s all departments must all be overseen comprehensively and holistically, at the highest level.

Rick Callaway’s Commercial Insurance team at can provide businesses an ounce of prevention that is worth a lot more than a pound of cure. A little precaution before a crisis occurs is preferable to a lot of fixing up afterward. We are the extra-milers in protecting businesses, employers, employees, business assets, AND from liabilities.  “Protect Businesses, Extra Miles.”