INDUSTRY FACT FILE · HOSPITALITY, TRAVEL & TOURISM

Five New Case Studies in Hospitality and Travel Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in hotels, travel platforms, tour operators and loyalty programmes and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Extranet Login That Robbed the Guests 3.  Case Study 2: The PMS Vendor That Opened Every Door 4.  Case Study 3: The Deposit That Left With the Email 5.  Case Study 4: The Points That Became Plane Tickets 6.  Case Study 5: The Resort That Ran on Paper

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining control failures widely observed in hospitality and travel with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, DPDP, RBI tokenisation and PCI DSS, immigration reporting, SEBI disclosure for listed companies and brand and OTA contracts.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Extranet Login That Robbed the Guests	Boutique hotel group	OTA extranet account takeover	DPDP; CERT-In; OTA contract	B10, B7, B2
2. The PMS Vendor That Opened Every Door	Hotel management company	Cloud vendor breach exposing guest identity data	DPDP; SEBI LODR; brand contracts	B9, B6, B7
3. The Deposit That Left With the Email	Tour operator and MICE agency	Business email compromise of deposit flows	CERT-In; DPDP; client contract	B10, B7, B2
4. The Points That Became Plane Tickets	Hotel loyalty programme	Credential stuffing and redemption fraud	DPDP; CERT-In; partner contracts	B2, B7, B6
5. The Resort That Ran on Paper	Resort group	Ransomware on PMS, PoS and key systems	CERT-In; PCI DSS; SEBI LODR	B3, B7, B10

The guests paid the hotel. The hotel never saw a rupee.

At a glance
Organisation	A boutique hotel group (“Stayco A”) with eight properties selling mainly through OTAs
Threat	A reservations desk account compromised by phishing and used on the OTA extranet to message upcoming guests for 'payment verification'
Why it is new	Attackers now use the hotel's own distribution channel to reach guests
Codec Networks services	Phishing simulation and training, SOC monitoring, extranet and payment review (Bundles B10, B7, B2)

The scenario

Stayco A's reservations desk received an email styled as an OTA guest complaint. A staff member entered the extranet password on the linked page; the account had no MFA.

Over two weekends the criminals messaged upcoming guests through the platform, claiming card verification had failed and directing them to a payment page in the hotel's name. Dozens of guests paid.

Complaints reached the OTA before the hotel noticed. Stayco A faced refund disputes, a platform penalty, a privacy question about the guest data viewed and weeks of reputation repair.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• No MFA on extranet or channel manager accounts.
• Reservations staff untrained on OTA-themed phishing.
• No monitoring of extranet logins or guest messaging.
• No playbook for guest fraud and takedowns.

The impact

Stayco A refunded guests, paid platform penalties, reported the incident and rebuilt its distribution account security.

The regulatory lens

• DPDP: guest booking data accessed through the extranet.
• CERT-In Directions: incident reported within six hours.
• OTA contract: platform security and guest-protection obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Train and rehearse	Phishing simulation for reservations teams and a guest-fraud tabletop	B10
Watch the channels	SOC monitoring of extranet logins, messaging anomalies and look-alike sites	B7
Harden the flows	Extranet account review, MFA and payment link controls	B2

Key lessons Enforce MFA on every distribution account. Train reservations teams on OTA-themed phishing. Monitor extranet activity and guest messages. Be ready to warn guests and take down fakes.

The hotels did nothing wrong. Their guests' passports leaked anyway.

At a glance
Organisation	A listed hotel management company (“Hotelco B”) operating 60 properties on a cloud PMS
Threat	A PMS vendor's support account compromised and used to download reservation and identity data across hundreds of properties
Why it is new	Vendor-held guest data is the biggest concentration of risk in hospitality
Codec Networks services	Vendor assurance, DPDP programme, SOC (Bundles B9, B6, B7)

The scenario

Hotelco B's cloud PMS vendor had a support portal without MFA that allowed bulk exports. A support engineer's credentials were stolen from an infected personal device.

Reservation records, scanned passports and card tokens for Hotelco B and many other operators were downloaded. Weeks later, samples appeared on a leak site.

Hotelco B learned of the breach from journalists. It had no inventory of what the vendor held, no contractual notification clause and no plan for notifying guests across brands and owners.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No vendor security assessment or contractual breach-notification clause.
• Identity data over-retained and exportable in bulk.
• No monitoring of vendor access or exports.
• No cross-brand breach-response plan.

The impact

Hotelco B notified guests and owners, disclosed the incident quarterly, faced DPDP questions and reworked its vendor contracts and data retention.

The regulatory lens

• DPDP: guest identity data held by a processor; fiduciary accountability.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.
• Brand and owner contracts: notification and remediation obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess and contract	Vendor security assessments and breach-notification, audit and recovery clauses	B9
Minimise and map	DPDP programme with data mapping, retention limits and breach playbooks	B6
Watch the vendor	Monitoring of vendor access and bulk data exports	B7

Key lessons Know what every vendor holds. Put notification and audit rights in contracts. Minimise and expire identity data. Plan breach response across brands and owners.

The invoice looked right. The account number was not.

At a glance
Organisation	A tour operator (“Tourco C”) organising conferences and incentive trips for corporate clients
Threat	A sales manager's mailbox accessed after password reuse and used to send a 'revised' invoice with new bank details for a large event deposit
Why it is new	Event deposits are large, time-bound and paid on trust
Codec Networks services	BEC simulation and training, SOC monitoring, payment flow review (Bundles B10, B7, B2)

The scenario

A sales manager at Tourco C reused a password that had leaked from another service. The mailbox had no MFA, and a forwarding rule quietly copied every message about a large corporate conference.

Days before the deposit was due, the client received a revised invoice from the genuine mailbox with new bank details and a plausible explanation. The client's accounts team paid.

The diversion was discovered when Tourco C chased the overdue deposit. Recovery was partial, the client terminated the contract and filed a complaint, and Tourco C reported the incident.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No MFA on sales and finance mailboxes.
• No monitoring of forwarding and mailbox rules.
• No agreed protocol with clients for invoice or bank-detail changes.
• Sales and finance staff untrained on BEC.

The impact

Tourco C lost a key client and most of the deposit, faced a complaint and rebuilt its payment communication and mailbox security.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• DPDP: client and traveller data in the compromised mailbox.
• Client contract: payment and confidentiality obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Train and rehearse	BEC simulation and training for sales and finance teams	B10
Watch the mailboxes	Monitoring of mailbox rules, logins and invoice anomalies	B7
Harden the flows	Payment communication protocol and verification controls	B2

Key lessons Enforce MFA and block password reuse. Alert on mailbox rules and unusual logins. Agree a verification protocol with every client. Train sales and finance teams on BEC.

Members had not logged in for months. Their points were flying.

At a glance
Organisation	A hotel group's loyalty programme (“Loyalco D”) with partner redemptions for flights and gift cards
Threat	Automated login attempts using leaked credentials taking over member accounts and redeeming points through partner integrations
Why it is new	Loyalty points are a liquid currency with weaker controls than payments
Codec Networks services	Application and API testing, SOC fraud analytics, DPDP (Bundles B2, B7, B6)

The scenario

Loyalco D's login had no bot management or rate limiting, and many members reused passwords. Automated attempts using leaked credential lists succeeded on thousands of accounts.

Points were redeemed for flights, stays and gift cards through partner integrations that required no step-up verification. Members discovered empty accounts and complained publicly.

Partners clawed back redemptions, members were compensated and a privacy inquiry asked how member data had been protected.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No bot management or rate limiting on login.
• No MFA or step-up verification for high-value redemptions.
• Partner redemption APIs untested for abuse.
• No anomaly detection on redemptions.

The impact

Loyalco D compensated members, absorbed partner clawbacks, answered regulators and rebuilt its login and redemption controls.

The regulatory lens

• DPDP: member profiles and travel data exposed through account takeover.
• CERT-In Directions: incident reported within six hours.
• Partner contracts: redemption integrity and clawback terms.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the platform	Application and API testing, bot resistance and partner API review	B2
Watch redemptions	SOC fraud analytics and anomaly detection	B7
Protect members	DPDP programme and member notification playbook	B6

Key lessons Treat points like money. Manage bots and rate-limit logins. Require step-up verification for redemptions. Monitor redemption patterns.

Peak season, full house, and every key card was dead.

At a glance
Organisation	A listed resort group (“Resortco E”) with twelve properties and a shared IT contractor
Threat	Ransomware encrypting PMS interface servers, PoS, the key-card system and backups after an IT contractor account was compromised
Why it is new	Property systems share networks and credentials more often than anyone admits
Codec Networks services	Segmentation and recovery, SOC, crisis exercises (Bundles B3, B7, B10)

The scenario

Resortco E's IT contractor was phished, and the attackers gained administrative access that reached every property over several weeks.

On the first night of the peak season they encrypted PMS interfaces, PoS, the key-card system and the backup server. Guests queued at reception while staff issued paper keys and handwritten bills.

Bookings leaked to competitors. Resortco E refused to pay, rebuilt over two weeks with vendor help, reported the incident and disclosed it in its quarterly report.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Contractor account with administrative access across properties and no MFA.
• PMS, PoS, key and backup systems on one network.
• EDR alerts not monitored 24x7.
• No manual operation playbook rehearsed with properties.

The impact

Resortco E lost two weeks of peak-season revenue, paid recovery costs, disclosed the incident quarterly and rebuilt its property network and contractor controls.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• PCI DSS and acquirer rules: PoS compromise investigated and reported.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	Segmentation of PMS, PoS, key and building networks; immutable backups; tested restores	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Rehearse the outage	Manual check-in, billing and key playbooks and crisis exercises	B10

Key lessons Limit and monitor contractor access. Segment property systems from office IT. Keep backups off the domain and test restores. Plan to run a property on paper.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com