Manidweep Resorts Ltd, a group of luxury hotels, had properties across all the major locations in India. Company's management was planning to expand operations to other countries for global footprint and raise funds for

Data security in hospitality sector is one of the major concerns in view of the nature of the data collected by companies operating within hospitality. Hotels, motels, resorts, and rented apartment complexes all gather and electronically store a range of sensitive personal guest data, such as names, phone numbers, addresses, and credit card details. From the perspective of cybercriminals, hospitality appears to offer an ideal target vector for conducting crimes such as identity theft and credit card fraud due to the existence of multiple databases and devices containing both Payment Card Information (PCI) and Personally Identifiable Information (PII). In view of this, it is important to look at the following data security concerns in the hospitality sector. (a) Complex Ownership Structures: Hospitality sector often have complex ownership structures in which there's a franchisor, an individual owner or group of owners, and a management company that acts as the operator. Each of these groups may use different computer systems to store information, and the information can also frequently move across those systems. Hackers can gain access to the systems of an individual operating company through easily guessed passwords, and the attack easily proliferated through the entire corporate network, with the result that customers had their information compromised. (b) Payment through Cards: The nature of the hospitality industry is such that it is extremely reliant on cards as a form of payment. Cybercriminals use this reliance on cards to infect point-of-sale (POS) systems with malware that steals credit and debit card information by scraping the data. (c) High Staff Turnover: The risk is that the hospitality industry involves lots of seasonal work in which people might move on after only a few months, or they might be transferred The high level of turnover and high degree of staff movement between different locations makes it a real challenge to maintain teams of well-trained staff who can protect sensitive data. (d) Insider Threats: It involves employees selling data of customer to third parties without the knowledge of the organization that employs them. This data could be potentially lucrative when it ends up in the hands of those who know how to use it to gain a competitive advantage. Best practices for companies in the hospitality sector to protect data include: Always encrypt payment card information. Operate a continuous training program in cybersecurity to maintain a well-trained workforce. Always adhere to relevant regulations, such as PCI DSS. Use cybersecurity measures such as firewalls, network monitoring, anti-malware, and traffic filtering to protect against common threats. Conduct tests against your organization's cybersecurity defenses in which you mirror the behavior of an actual hacker. Know where the data is and enforce the principle of least privileges to limit access to sensitive information.