Cybersecurity: The Top Threats To Look Out For

The issue of cybersecurity attacks is not a new phenomenon. Cyber threats have been prevalent since the inception of the internet, but in recent years, their frequency and severity have grown significantly. The average cost of a data breach sitting at $4.99 million according to IBM—a 12% increase since last year, and a record high. As a result, it is imperative for businesses to enhance their security measures to combat the ever-evolving landscape of cyber threats.

Cybercrime can have a significant impact on various sectors and industries, with the travel and tourism sector being particularly vulnerable. The vast amount of secure and personal data handled by the travel and hospitality industry makes it a prime target for cyber attacks. Therefore, it is crucial for travel businesses to prioritise cybersecurity measures to safeguard sensitive information and protect both their businesses and their customers. 

As the digital ecosystems of the travel and tourism industry continue to expand, they will also become increasingly susceptible to cybercrimes. It is crucial for companies within the travel and tourism chain to prioritise cybersecurity awareness, strategies, and safeguarding in order to ensure the utmost security of their data.

Why is the travel industry susceptible to cybercrime?

As a global industry with many – literal – moving parts, the travel industry is often targeted by cybercriminals. Analysis of data breaches and cyberattacks have identified numerous reasons for this, such as:

• The industry’s huge fragmentation.
• The complexity of the travel booking and payment networks/platforms.
• The existence of many travel agents and third-party service providers.
• Poor security systems when it comes to IT and point-of-sale (POS).
• Human error.
• The millions of travellers all interacting with travel distributors within cyberspace.

How can travel businesses mitigate cyber-attacks?

Human error was identified as one of the biggest threats to cybersecurity, so many common cyberthreats may be avoidable with the right education.

It’s estimated that around 99% of data breaches will be caused by a misconfiguration within settings or installation by an end user. So, this suggests that with proper education and a thorough cybersecurity strategy, travel distributors will be able to mitigate the impact and severity of many common cyberthreats.

What a good cybersecurity strategy should involve:

• Contingency planning
• Immediate actions outlined – for varying types of breach or attack once discovered
• Post-breach responses  
• An understanding of current cyber risks

Here is where consolidating your tools and resources, and leveraging third-party expertise to manage complexities and augment capabilities, can give you a leg-up when it comes to protection against those more common threats. 

As cyberattacks continue to evolve and grow more sophisticated, it is clear that implementing frequent company-wide training can be an effective strategy in mitigating the risks associated with data breaches. The alarming statistics on data breaches underscore the importance of staying updated on the latest threats and taking proactive measures to safeguard sensitive information.

But for now, let’s look at some of the most common cybersecurity threats and what shape they take, to help you as travel distributors improve your awareness.

AI-Accelerated Cybercrime

According to recent IBM data, the use of agentic AI has significantly grown the scale of cybercrime operations in the last few years: 

• 44% YoY increase in public-facing software or system applications being exploited.
• The share of disclosed vulnerabilities that did not require authentication to be exploited rose to 56%.
• The number of AI chatbot credentials listed as for sale on the dark web rose to 300,000.
• 49% increase in ransomeware groups noted as active, compared to 2025.

With common operations scaled through the use AI, the security of people, data and business security infrastructure must be proactively protected by robust measures.

Such measures include autonomous security operation centres, which also use agentic AI, to augment the roles of security workers, and can mobilise agents to work across the entire threat cycle, from 'threat-hunting' (the search for risks and anomalies), to recovery and remediation.

However, it's important to understand the types of commonly encountered cybercrime in order to proactively work against these operations, even if they are being accelerated by AI: 

Social Engineering

Social engineering is widely recognised as one of the most common and hazardous tactics used by cybercriminals. This is mainly due to the fact that social engineering, in its many forms, exploits human mistakes rather than technical weaknesses. It is much simpler to deceive or influence individuals than it is to penetrate a security system, and it is apparent that cybercriminals are well aware of this fact. Research indicates that around 60 to 62% of all data breaches stem from human interaction or error.

Over recent years, social engineering techniques played a crucial role in cybercriminals gaining access to employee data and credentials for the purpose of carrying out cyberattacks. 

Among these techniques, phishing stands out as a leading cause of data breaches, with data from Verizon 2026 Data Breach Investigations Report suggesting that:

• More than 31% of all breaches now start with software vulnerabilities. 
• There are 40% higher click rates for mobile devices, via fake texts or a scam calls, which make them the 'new favourite target' as people become savvier at spotting traditional phising emails.

It is important to note that these tactics are continuously adapting to leverage emerging trends and technologies in order to stay ahead of security measures.

What can phishing attacks look like?

• Spear phishing – this targets specific individuals or organisations, hence the term ‘spear’, most typically using malicious emails. The goal of these emails is to obtain sensitive data, such as login credentials, or to infect the users’ devices with malware (which we will explore later).
• Whaling – a type of attack that targets senior or C-level executive employees, with the aim of stealing money or information on the business, or to gain access to their devices to carry out further attacks.
• Vishing – the use of fraudulent phone calls or voice messages, often masquerading as a legitimate business, to convince individuals to share sensitive, private data such as bank details and passwords.
• SMiShing – the use of fraudulent text messages, in much the same way as ‘Vishing’, to steal sensitive, private data. This can often take the shape of your bank or a shipping service. 

Other social engineering techniques can involve:

• Business email compromise (BEC) - a prominent technique in which attackers assume the identities of trusted email addresses – often internal business users – to trick other employees or clients of the business into sharing data that could compromise the business, or make payments, amongst other goals.
• Pretexting – here cybercriminals gain access to a system or a user account using a false scenario that gains the victims trust through manipulation. Attackers could pose as a HR employee, or an IT specialist, for example.
• Disinformation campaign - these spread false information, usually with the goal of amplifying fake narratives using bots and fake accounts on social media networks. 

Among these techniques, travel distributors are most likely to encounter business email compromise attacks, primarily due to the extensive chains of internal communication. Once attackers gain access, they typically send phishing emails to employees or clients of the business to obtain more sensitive data or prompt financial transactions. They may also utilise the compromised account to launch attacks against other employees or the businesses' systems.

Business email compromise attacks can be carried out in multiple ways, including:

• Phishing – as explained above, this type of attack often uses emails to trick employees into sharing sensitive data and are usually from a ‘trusted’ source. Social engineering techniques are then used to prompt the recipient into action.
• Malware – this is the use of malware – malicious software - to infect a user’s computer and therefore gain access to their email accounts. Once installed, this malware can steal other sensitive data from this computer.
• Social engineering – often, this type of attack (closely linked to phishing), tricks employees into divulging sensitive information or grant access to their email accounts. Usually, this involves impersonation to gain trust.
• Manipulation of weak passwords – if employees use ‘weak’, reused, or easily guessable passwords, cybercriminals can obtain access to internal email systems by guessing these passwords. 

How can travel distributors protect against business email compromise?

• Train employees on how to identify and avoid phishing emails.
• Insist employees use strong passwords and two-factor authentication.  
• Keep software and cybersecurity systems up to date.
• Implement email cybersecurity measures, such as spam filters.

Third-Party Security Treats

Third-party breaches are ever-numerous for companies, as independent contractors have become far more commonplace over the last few years.

Consequently, this has led to a larger pool of less secure networks that have access to the main target, all of which were associated with these third parties. These less-secure networks are exploitable by hackers, as seen in the memorable attack on the U.S’s Colonial Pipeline in 2021, by obtaining compromised credentials, accessing a VPN without multi-factor authentication, and demanding a $5 million Bitcoin payment to regain access.

In fact, around 73% of executives and business leaders cite distributed and third-party workers as a major cybersecurity vulnerability, according to remote-first data from Forbes. This brings about ongoing challenges in third-party security threats for businesses of all sizes. 

Cloud Vulnerabilities

With many more businesses adopting cloud-based systems, the growth of cloud-based cyberattacks likewise grows. It’s estimated that cloud security is the fastest-growing cybersecurity market, especially with the weaponisation of artificial intelligence and an explosive growth in machine identities.

In today's fast-paced environment, with cloud-based systems taking on more corporate workload, businesses are turning to 'zero trust cloud architecture' for enhanced security. This approach, designed to assume a system has been compromised, requires additional verification before granting access to recognised devices, or any device within the perimeter of the network.

Keeping on top of cloud security practices is critical, and can include:

• Monitoring access to sensitive resources.  
• Enforcing strict password requirements.  
• Implementing a sound data backup plan.
• Leveraging data encryption.

What are the most common cloud-based threats?

Commonly referred to as the ‘egregious eleven’ by security professionals, these are the most ‘popular’ access points:

1. Data breaches
2. Misconfiguration and inadequate change control
3. Lack of cloud security architecture and strategy
4. Insufficient identity, credential, access and key management
5. Account hijacking
6. Insider threat
7. Insecure interfaces and APIs
8. Weak control plane
9. Metastructure and applistructure failures
10. Limited cloud usage visibility
11. Abuse and malicious use of cloud services 

Supply Chain Attacks

A recently emerging tactic, supply chain attacks involve the breach of supply chain technology, such as Application Programming Interfaces (API systems), commonly found in the travel industry. This infiltration allows access to source codes, build codes, and other software components. The attackers then exploit these legitimate platforms and applications to disseminate malware throughout the supply chain systems.

Considering how often supply chain systems are used within the travel and tourism industry – particularly through API integration – it’s important to know how to reduce the risk of this kind of attack.

In the modern travel industry, travel APIs are a powerful tool that many businesses utilise. By allowing different systems to communicate seamlessly, they create a unified platform where customers can easily access all travel products in one place. These API systems are highly effective in helping travel businesses create user-friendly systems that stay ahead of hospitality tech trends. It also means travel businesses can enhance their business success by increasing their distribution through API integration, offering customised tour packages or itinerary planning, providing quotes, or displaying availability and booking options.

However, these systems are also vulnerable to attacks. But hope is not lost! There are many ways to protect against supply chain threats, including:

• Use endpoint monitoring tools to spot and stop suspicious activity.  
• Stay current with all system patches and updates.  
• Implement integrity controls to ensure users are only running tools from trusted sources.  
• Require admins and other users to use two-factor authentication.

Ransomware

While certainly not a new threat, ransomware attacks have become significantly more expensive in the last few years – with costs expected to reach $265 billion by 2031 - and so continue to present considerable challenges to businesses of all sizes.

Ransomware, in essence, is a form of malicious software that restricts access to computer systems until a ransom is paid. This involves utilising malware to seize control of computer systems, retrieve data, files, or sensitive information, and then requesting payment in exchange for restoring access to the original user.

Of course, before the ransomware attack can take place, hackers must obtain access to their targets’ systems. The most common methods of infiltration include:  

• Phishing
• Remote Desktop Protocol (RDP) and credential abuse - wherein hackers use ‘brute-force’ or purchase credentials with the goal of logging into systems to distribute malware.
• Exploitable software – such as unpatched or out-of-date software. 

Modern endpoint detection and response (EDR) technology can often protect against ransomware attacks, by stopping the execution of malicious software in the first place. Many businesses also benefit from the setting of cybersecurity parameters, to keep employees from straying too far from safe browsing locations on their corporate devices. 

The Internet of Things

In the realm of technology, physical objects, the 'Things' in 'Internet of Things, are evolving to be more intelligent by integrating sensors, software, and other advanced technologies. As we continue to depend on these interconnected Things to communicate and exchange information online, their vulnerability to cyber threats also increases.

While there are multiple ways that smart devices and objects are connected to an online network, some of the most common methods are: 

Default passwords: Hackers can exploit default passwords often supplied for smart devices, or easily guess reused and weak passwords or access codes for individual or business devices. These are then used to gain access to the device, its data, and facilitate further attacks.

Unsecured Wi-Fi networks: public Wi-Fi networks are often unsecured or use weak encryption, and these can be exploited to intercept data. 

Fortunately, there are ways to protect your devices, including:  

• Having users select secure passwords, changing them frequently, and not sharing this information.  
• Staying current with Operating System (OS) and software updates.
• Encouraging clients to encrypt their data.
• Installing antivirus or anti-malware protection.
• Changing default passwords.  
• Avoiding unsecured Wi-Fi networks.  
• Being cautious of suspicious emails or links.

Financial and reputational loss

The repercussions of a cybersecurity breach can have widespread and severe implications for businesses, regardless of their size. Small businesses may never fully bounce back from an attack, and larger businesses could be subjected to penalties, legal action, a decrease in clientele or staff, as well as tarnishing their reputation.

For many travel businesses, one of the key consequences will be the loss of reputation, which—should the business recover—will involve a long and detailed strategy to recover this reputation both for existing and potential customers. After all, how many people are going to choose a company that, from an external perspective, hasn’t protected its customers?

Another main consequence is the disruption to operations following a breach or attack, the consequence investigation that must take place, and the change to business practices after the resolution of the attack.  

Deepfakes and the escalating threat of simulated content

Deepfakes are a significant threat within the realm of synthetic media, utilising artificial intelligence and machine learning to produce highly convincing videos, images, audio, and text that depict fictional events.

Beyond ‘face swapping’ and lip syncing, which can convincingly alter individuals' expressions, deepfakes also create 'puppet master deepfakes,' mapping faces onto different bodies. While content manipulation is not new—with 'cheapfakes' existing for years—advancements in deepfake technology make it increasingly accessible and sophisticated, posing a rising threat.

What sets deepfakes apart is their ability to be created with minimal technical skill, complicating the task of discerning authentic content from fabricated material. This evolution represents a direct threat to national security, law enforcement, and society at large.

This threat landscape is influenced by various factors, including the growing prevalence of AI-generated content, legal regulations, and public trust in visual media. As awareness of deepfakes increases, malicious actors may accelerate their activities, intensifying risks for vulnerable individuals and organisations across all sectors.

Ensuring that your business has strong cybersecurity protection and awareness at all levels is essential to defend against the common cyber attacks mentioned earlier. Seeking expert training and advice from security professionals will help keep your business practices, cybersecurity strategies, and overall understanding of cyber threats current and effective.

And for even more understanding of cybersecurity, as vast and ever-evolving as it is, discover more guidance on the Americas Cyber Defense Agency, which 'provides information on cybersecurity best practices to help individuals and organisations implement preventative measures and manage cyber risks.'