A hotel can have strong cybersecurity controls and still suffer a breach through someone else’s technology.
Property management systems (PMS), booking platforms, payment gateways, cloud applications, guest Wi-Fi and smart-room technology increasingly exchange data across interconnected hotel systems.
Discover B2B Marketing That Performs
Combine business intelligence and editorial excellence to reach engaged professionals across 36 leading media platforms.
Find out more
These integrations can improve efficiency and the guest experience, but they also increase the number of external organisations with access to hotel data and infrastructure.
The wider cybersecurity picture shows why third-party exposure deserves attention. Verizon’s 2025 Data Breach Investigations Report found that the percentage of breaches involving third parties doubled to 30%, while exploitation of vulnerabilities increased by 34% globally.
For hotel operators, the question is not simply whether a technology supplier has strong cybersecurity. It is also what happens when that supplier is compromised: who is responsible, how quickly will the hotel know, what systems and data could be affected, and can the hotel continue operating?
Why third-party hotel technology creates risk
Modern hotel technology rarely operates in isolation.
A PMS may exchange information with a booking engine, channel manager, revenue-management platform and customer relationship management system. Payment information may pass through a separate payment provider.
Guests may connect through a third-party Wi-Fi platform, while smart locks, televisions and other connected devices can depend on external software and cloud services.
The result is a technology supply chain that can be difficult for a hotel to see in full.
A hotel may depend not only on its direct technology suppliers, but also on companies further down the supply chain. A managed IT provider, for example, may have privileged access to hotel systems for maintenance or support.
An integration may automatically transfer data between platforms, while a cloud provider may host an application containing sensitive information. Suppliers may also rely on their own subcontractors or sub-processors.
This lack of visibility is a recognised cybersecurity problem. NIST guidance on cybersecurity supply-chain risk management identifies reduced visibility into how acquired technology is developed, integrated and deployed as a source of supply-chain risk. It recommends identifying, assessing and mitigating cybersecurity risks throughout the supply chain.
For hotels, the potential exposure can be significant. Systems may contain guest names and contact details, booking information, identification details, payment-related information, loyalty data and records of guest preferences.
But data theft is only part of the risk.
If an integration or cloud service is disrupted during a cyber incident, a hotel could lose access to reservations, payment processing, digital keys or other operational systems. A supplier incident therefore does not have to expose guest information to become a serious business problem.
This is particularly important for hotel groups that depend on central technology platforms. An incident affecting one provider could disrupt operations across multiple properties at the same time.
A hotel does not need to own a technology system to inherit the risk associated with it. Third-party cybersecurity is therefore also a question of operational resilience.
Who is responsible when a technology provider is breached?
There is no single answer. Responsibility depends on the hotel’s relationship with the supplier, the type of data involved, the supplier’s role, contractual arrangements and the laws that apply.
Outsourcing a technology service does not necessarily outsource the hotel’s responsibilities.
A technology provider may be responsible for a security failure within its systems. The hotel may nevertheless have obligations to assess what happened, protect affected individuals, notify relevant parties or regulators where required, and maintain business continuity.
Data-protection rules provide one example. Under the UK GDPR, an organisation that determines why and how personal data is processed is generally the controller, while an organisation processing that information on its behalf can be a processor.
Processors have their own legal obligations, including implementing appropriate security measures and notifying the controller without undue delay if they become aware of a personal-data breach.
The controller, meanwhile, remains responsible for ensuring that its processing, including processing carried out by a processor, complies with the UK GDPR.
Contracts are therefore an important cybersecurity control as well as a procurement document.
UK GDPR requirements for controller-processor arrangements cover areas including security, confidentiality, processing instructions, sub-processors, assistance with compliance and what happens when the contract ends. The ICO also says controllers should assess processors before appointment and monitor their compliance on an ongoing basis.
That can become critical during an incident. A hotel cannot assess its own exposure effectively if a supplier does not provide sufficient information about a suspected breach or does not provide it quickly enough.
Payment security follows a similar principle. Under the Payment Card Industry Data Security Standard (PCI DSS), using a third-party service provider does not remove a merchant’s responsibility for ensuring that account data is properly protected.
Merchants must manage and oversee their third-party relationships, maintain appropriate agreements, understand shared responsibilities and monitor providers’ PCI DSS compliance status at least annually.
The position can differ where a technology company is acting as a controller in its own right rather than as a processor for the hotel. Hotels should therefore establish the contractual and regulatory position for each supplier relationship rather than assume the same allocation of responsibility applies across their technology estate.
For international hotel groups, the position can become more complex because data-protection, breach-notification and cybersecurity requirements vary between jurisdictions. Supplier arrangements therefore need to reflect where the hotel operates and the data it handles.
How hotels can manage third-party technology risk
Third-party cybersecurity begins with visibility. A hotel cannot manage supplier risk effectively if it does not know which companies have access to its systems, data or critical operations.
Hotels should maintain a register covering technology suppliers and integrations.
This should extend beyond the largest technology contracts to include PMS providers, booking and distribution platforms, payment processors, cloud applications, guest Wi-Fi providers, managed IT companies, smart-room suppliers and other organisations with meaningful access to hotel systems or information.
Operators should understand what each supplier can access, what information it handles, which systems it connects to and whether it relies on other companies to deliver the service.
Not every vendor requires the same level of scrutiny. A supplier with privileged access to hotel infrastructure, large volumes of guest information, payment-related data or an operationally critical system presents a different level of risk from a provider with limited access to non-sensitive systems.
Hotels can classify suppliers according to factors such as the sensitivity and volume of information involved, level of system access, operational importance and difficulty of replacing the service. This allows hotels to focus due diligence and monitoring on suppliers whose failure would have the greatest impact.
NIST’s supply-chain risk-management guidance recommends assessing suppliers and services for factors including cybersecurity, resilience and wider supply-chain dependencies.
For hotels, this can translate into practical questions during procurement and contract reviews:
- What guest, employee or payment information does the supplier handle?
- Which hotel systems can the supplier access, and is that access limited to what is necessary?
- How is privileged or remote access controlled?
- Which sub-processors or other suppliers could access hotel data through the service?
- When must the supplier notify the hotel of a suspected or confirmed security incident?
- What evidence can the supplier provide about its cybersecurity controls?
- How will the supplier support the hotel during an investigation or recovery?
- What happens to hotel data when the relationship ends?
- How will the hotel continue operating if the supplier’s service becomes unavailable following a cyber incident?
These questions should not be treated as a one-off procurement exercise. A supplier initially considered low risk may become more important as new integrations are added or the amount of information it handles increases.
Hotels should also review how suppliers access their technology environments. Third-party accounts and privileges should be limited to what is required to provide the service and reviewed periodically.
Unnecessary accounts, excessive privileges and access retained by people who no longer need it can create avoidable exposure.
Contracts should support these technical controls. Depending on the service and regulatory requirements, agreements may need to address security standards, incident notification, sub-processors, investigation support, access controls, data retention and deletion, and what happens when the contract ends.
Incident-reporting requirements deserve particular attention. A supplier’s obligation to tell a hotel about a breach should be clear enough that the hotel knows when it will be informed, who will be contacted and what information the provider must supply.
The speed of that communication matters because the hotel may have its own regulatory, contractual and operational decisions to make once it becomes aware of an incident.
Hotels should also prepare for the possibility that a critical technology provider becomes unavailable.
Cybersecurity is not only about preventing unauthorised access or data loss. It is also about maintaining essential operations when systems fail or need to be disconnected during an investigation.
Critical suppliers should therefore be included in incident-response and business-continuity planning.
Hotels can consider how reservations would be accessed if a core platform went offline, whether alternative payment procedures are available, how properties would communicate with guests and staff, and which internal teams and external providers would need to coordinate during an incident.
This is particularly important where a technology service supports multiple properties. A failure affecting a central platform can create operational problems across an entire hotel group rather than at a single property.
Third-party technology is essential to modern hotel operations. The objective is not to eliminate these relationships, but to understand and manage the risks they create.
Hotels cannot control every aspect of a supplier’s cybersecurity. They can control how suppliers are assessed, how much access they receive, what contracts require, how dependencies are monitored and how the business prepares for an incident.
As hotel technology becomes more interconnected, third-party risk becomes part of hotel cybersecurity itself.
The critical question is no longer simply whether a technology supplier is secure. It is whether the hotel understands the supplier’s access, responsibilities and dependencies — and is prepared if that relationship becomes the route through which an incident reaches its systems, operations or guests.
