Hotel Cyber Insurance:
PMS, POS, Loyalty, and Guest Data Breach Coverage
Hotel cyber insurance covers the response, liability, and business interruption costs of a data breach or cyber attack on a hospitality operator — most commonly breaches of the property management system (PMS), point-of-sale (POS) network, loyalty program, or Wi-Fi infrastructure that expose guest payment card, passport, or personal data. Hospitality carries the third-highest breach cost of any industry, averaging $3.36 million per incident according to the IBM 2024 Cost of a Data Breach Report, and standard general liability and commercial property policies exclude virtually all cyber losses. Required program elements include first-party response (forensics, breach notification, credit monitoring), third-party liability (guest and card brand claims), cyber business interruption, ransomware/extortion coverage, and PCI fines and assessments coverage.
Photo by Random Institute
on Unsplash
- Hospitality is the third most-breached industry according to IBM's 2024 Cost of a Data Breach Report, with average breach cost of $3.36 million — well above the cross-industry average of $4.88 million but with disproportionate reputational and loyalty-program fallout. Hotels hold a rare combination of payment card data, passport/ID data, and behavioral data that makes them an unusually valuable target.
- The property management system (PMS) is the single highest-value target in a hotel's IT environment — it holds guest PII, reservation history, folio charges, and historically stored card data until PCI-compliant tokenization was adopted. Legacy on-premises PMS installations, flat networks with no segmentation, and third-party integrations (channel managers, OTA connectors, housekeeping apps) are the most common breach vectors we see in underwriting.
- Standard commercial general liability (ISO CG 00 01) expressly excludes access or disclosure of confidential or personal information (the 2014 "data breach exclusion" endorsement CG 21 06 and updated ISO language). Standard commercial property policies cover physical property, not data. A cyber-specific policy is the only form that responds to PMS/POS/loyalty breaches, ransomware, and guest data exposure.
- PCI DSS fines, forensic investigator (PFI) costs, card brand assessments, and card reissuance costs are excluded from most general liability policies and are often excluded or sublimited even within cyber policies. Explicit PCI fines and assessments coverage, typically a sublimit of $250,000–$1 million within a cyber policy, is a must-have for any hotel that accepts cards.
- Franchise agreements from Marriott, Hilton, IHG, Wyndham, Choice, and Best Western increasingly require standalone cyber liability coverage — typically $1M–$5M limit minimums — as a condition of maintaining franchise flag. Cyber coverage is no longer a "nice to have" for flagged hotels; it is a franchise default risk if uncovered.
- Cyber business interruption (system failure / network outage coverage) is distinct from property business interruption. A ransomware attack that shuts down the PMS and POS at a 120-room hotel can cost $200,000–$500,000+ in lost revenue over a 3–7 day outage — property BI will not respond because there is no physical damage; only a cyber BI section with a short (8–12 hour typical) waiting period will.
Why hotels are disproportionately targeted — and why standard coverage falls short
Hotels sit at an unusual intersection of data types that makes them among the most valuable targets in commercial cybercrime. A single hotel reservation record can contain name, address, email, phone, payment card (PAN/CVV historically, tokenized today), passport or government ID, travel companion data, arrival/departure dates, loyalty account details, and folio-level charges. Unlike a retailer that collects payment data at checkout or a bank that holds financial data, a hotel holds identity, payment, travel pattern, and behavioral data for the same guest across multiple stays — making each guest record highly monetizable on criminal markets.
The hospitality industry has carried this distinction for more than a decade. Marriott, Hyatt, Wyndham, InterContinental, and numerous independent chains have all reported major breaches since 2015, several involving hundreds of millions of guest records. The IBM 2024 Cost of a Data Breach Report identifies hospitality as one of the top three industries for breach costs, with an average of $3.36 million per incident — and that average masks significant tail risk at larger or flagged properties, where breaches can exceed $10M–$100M+ when regulatory fines, card brand assessments, class-action litigation, and loyalty program remediation are combined.
Standard commercial insurance does not address any of this. General liability policies have included explicit data breach exclusions (ISO CG 21 06 family of endorsements and updated core language) since 2014, and commercial property policies cover physical damage, not data. Even business interruption coverage on a property policy is generally unavailable for a cyber event because there is no "direct physical loss or damage" to trigger coverage. Cyber-specific policies — standalone or as a dedicated section on a package program — are the only mechanism that actually responds to hotel cyber events.
The four hospitality-specific systems cyber insurance has to cover
Hotel cyber exposure concentrates in four operational systems: the property management system (PMS), the point-of-sale (POS) network for F&B and retail, the loyalty program and member portal, and the guest-facing network infrastructure (Wi-Fi, in-room entertainment, keycard systems). Each system stores or transmits different data types, triggers different regulatory obligations, and requires different coverage features to respond effectively. Generalist cyber policies written without hospitality experience often miss one or more of these surfaces.
1. Property Management System (PMS)
The PMS is the central nervous system of a hotel — it handles reservations, check-in/check-out, folio, housekeeping status, and historically, card-on-file storage. Major PMS platforms include Opera (Oracle Hospitality), Infor HMS, Maestro, Cloudbeds, and Mews. Modern cloud PMS offerings largely tokenize card data and delegate card storage to PCI-certified gateways, but on-premises PMS installations — common at independent and older flagged properties — often still maintain guest PII, including passport or government ID images, for 3–7+ years of reservation history.
The most common PMS breach vectors we see underwriters asking about: (1) flat network architecture where the PMS server is on the same VLAN as housekeeping tablets or guest Wi-Fi; (2) vendor remote access without multi-factor authentication (MFA); (3) unpatched legacy Windows servers running PMS software; and (4) credential theft from front desk staff accounts via phishing. Cyber policy applications routinely require disclosure of PMS vendor, hosting model (cloud vs. on-prem), MFA on admin access, and network segmentation status.
2. Point-of-Sale (POS) network
F&B, retail, spa, and valet POS terminals process card-present transactions and are a classic attack surface for memory-scraping malware (e.g., the historical POS malware families that drove the 2013–2018 wave of retail and hospitality breaches). Hotel POS networks are particularly exposed because they typically connect back to the PMS for folio posting — creating a lateral movement path from an infected POS device to the broader guest data environment. PCI DSS segmentation requirements exist specifically to contain this risk.
3. Loyalty program and member portal
Loyalty accounts contain PII, stored points with real cash value, and often a saved payment method for redemptions. Account takeover (ATO) via credential stuffing — using usernames and passwords leaked from unrelated breaches — is the most common attack pattern. Marriott's Bonvoy, Hilton Honors, IHG One Rewards, and other large loyalty programs have all faced ATO incidents that resulted in points theft, fraudulent redemptions, and broader reputational harm. Cyber coverage should include funds transfer fraud and social engineering coverage that responds to loyalty-point theft, which is often classified as "digital asset" loss under policy terms.
4. Guest network, keycard systems, and IoT
Guest Wi-Fi, in-room entertainment and cast/streaming systems, and RFID keycard systems (Onity, Assa Abloy/VingCard, Salto) represent a growing attack surface. Keycard vulnerabilities have been publicly disclosed over the past decade (most recently the 2024 "Unsaflok" disclosure affecting millions of Dormakaba/Saflok locks), and IoT devices on guest networks are a frequent initial access vector. Cyber policies should not have exclusions for "failure of physical security" when the physical-security failure is caused by a network or software vulnerability.
| Attack Surface | Primary Data at Risk | Typical Breach Vector | Key Coverage Feature Needed |
|---|---|---|---|
| PMS (on-prem or cloud) | Guest PII, passport/ID, reservation history, folio charges | Credential theft, vendor remote access, unpatched OS, flat network | Privacy liability, breach response, regulatory defense, state notification |
| POS network (F&B, retail, spa, valet) | Payment card data (PAN, track data pre-tokenization) | Memory-scraping malware, lateral movement from flat network | PCI fines & assessments, card brand liability, forensic (PFI) costs |
| Loyalty program / member portal | PII, stored points value, saved payment methods | Credential stuffing / account takeover, phishing | Funds transfer fraud, social engineering, digital asset / loyalty-point coverage |
| Guest Wi-Fi, keycards, IoT | Access to guest devices and rooms; pivot into hotel network | Default credentials, unpatched firmware, public disclosure of vendor vulnerability | Network security liability, no exclusion for physical-security-failure-via-cyber |
The eight coverage components a hotel cyber policy must address
A hotel cyber program is structured as a bundle of first-party (your own loss), third-party (liability to others), and regulatory/fines coverages. Generalist cyber forms frequently sublimit or exclude the hospitality-critical pieces — PCI fines, cyber business interruption with a short waiting period, and ransomware with extortion negotiation support. The following eight components are the minimum coverage inventory for a flagged or independent hotel of any meaningful size.
First-party coverage (your own loss)
- Breach response / incident response: Costs of forensic investigation (IR firm retention), legal counsel (privacy counsel), public relations, and customer notification. Typically provided through a panel of vetted vendors with pre-negotiated rates. Look for: a 24/7 breach hotline, panel flexibility for out-of-panel counsel, and no sublimit or a high sublimit ($1M+).
- Cyber business interruption (network outage / system failure): Lost net income and extra expense during a cyber-caused outage. Look for: waiting period of 8–12 hours (not 24+), definition of "outage" that includes partial degradation (not only total system failure), and sufficient period of restoration (90–180+ days, not 30).
- Ransomware / cyber extortion: Ransom payments (where legal and OFAC-compliant), ransomware negotiator fees, and recovery costs. Look for: explicit coverage for ransom payments, recovery and rebuild costs, and betterment coverage if systems need to be upgraded post-incident.
- Data restoration: Cost to recreate or recover data destroyed or corrupted in an attack. Often bundled with ransomware/extortion coverage.
Third-party coverage (liability to others)
- Privacy liability: Defense and indemnity for claims by guests whose data was exposed — class actions, regulatory investigations, state attorney general inquiries. Look for: full limit available (not sublimited), and coverage for both electronic and physical records.
- Network security liability: Defense and indemnity for claims alleging the insured's network security failure caused loss to a third party (e.g., a connected vendor whose systems were compromised through the hotel's network).
- Media / content liability: Defamation, IP infringement, and related claims arising from the hotel's website, email, social media, or guest-facing digital content. Relevant for hotels with active content marketing or user-generated content (reviews, event pages).
Regulatory and industry-specific coverage
- PCI fines and assessments: Fines from card brands (Visa, Mastercard, Amex, Discover) under the PCI DSS framework, card brand assessments for fraud losses and card reissuance, and forensic investigator (PFI) costs. Look for: a sublimit of at least $500K–$1M, and explicit coverage for PFI costs (which can run $150K–$500K+ for a mid-size hotel breach).
- Regulatory defense and fines: Defense of investigations and fines under federal privacy laws (HIPAA if the hotel has an on-site clinic or spa; FTC Section 5), state privacy laws (California CCPA/CPRA, Colorado, Virginia, Connecticut, Utah), international regulations (GDPR for EU guest data), and state breach notification statutes. Look for: coverage applicable to all 50 state breach notification statutes and explicit GDPR defense coverage if the hotel markets to or hosts EU guests.
PCI DSS v4.0 obligations and why hotel cyber coverage must address them
Any hotel that accepts payment cards is contractually bound — through its merchant acquirer agreement — to comply with the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS v4.0, which became the only effective version on March 31, 2024 with full enforcement of new requirements by March 31, 2025, imposes 12 core requirement areas covering network segmentation, encryption, access controls, monitoring, and vulnerability management. A PCI-regulated breach does not just create privacy liability — it creates a parallel track of card-brand-driven costs that general privacy insurance may not address.
The PCI cost cascade after a card breach
When a hotel suffers a confirmed card data breach, the card brand network triggers a defined process through the hotel's acquirer: (1) appointment of a PCI Forensic Investigator (PFI) from a small list of approved firms, at the hotel's cost, to determine the scope of the breach and whether the hotel was PCI compliant at the time; (2) card brand fines levied against the acquirer and passed through contractually to the hotel, typically ranging from $5,000 per month of non-compliance to $100,000+ per incident for large breaches; (3) card brand assessments for actual fraud losses on compromised cards and for the cost of card reissuance by issuing banks (typically $3–$10 per card reissued, multiplied by the number of affected cards); and (4) in serious cases, termination of the hotel's ability to accept cards at all.
None of this is covered by a standard general liability policy. Within cyber policies, PCI fines and assessments are frequently either excluded or sublimited to a low amount ($100K–$250K) that is inadequate for anything beyond the smallest breach. For any hotel with meaningful card volume, we look for an explicit PCI fines and assessments sublimit of $500K–$1M+ and confirmation that PFI costs are covered under the breach response section.
State breach notification laws, PII scope, and the 50-state compliance problem
All 50 U.S. states, plus the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands, have enacted breach notification statutes requiring notification to affected residents — and in most cases, state attorneys general and consumer reporting agencies — when certain categories of personal information are exposed. A hotel breach is almost always a multi-state event: a 200-room property on an average night has guests from 20–40 states, each of which may trigger a notification obligation under its own statute with its own definition of PII, its own timeline, and its own format requirements.
Most state breach notification statutes define PII to include name plus one or more of: Social Security number, driver's license number, financial account number (with access code or security code), health information, or biometric data. Newer statutes (California CPRA, Colorado CPA, Virginia CDPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA) have broadened this to include categories relevant to hotels: passport or other government ID numbers, email address plus password, and in some cases, even precise geolocation data. Several states (California, New York, Oregon, Massachusetts) impose specific attorney general notification requirements that run in parallel to consumer notification and can carry their own short timelines.
Federal and international overlay
In addition to state statutes, hotel breaches can trigger: (1) HIPAA obligations if the hotel operates an on-site clinic, spa with medical procedures, or collects health-related guest preferences classified as PHI; (2) FTC Section 5 enforcement for unfair or deceptive practices, particularly when a hotel's privacy policy misrepresents its data practices; (3) SEC cyber disclosure obligations for publicly traded REIT owners and public parent companies; and (4) GDPR obligations for hotels that market to or host EU residents, with a 72-hour notification window to supervisory authorities and potential fines up to 4% of global annual revenue. A cyber policy's regulatory defense coverage must be broad enough to respond across this full stack — otherwise, even a moderately sized breach can exhaust the limit on defense costs alone before indemnity coverage is reached.
Franchise cyber insurance requirements — what Marriott, Hilton, IHG, and others expect
Every major hotel franchise family has incorporated cyber insurance requirements into its franchise disclosure documents and brand standards manuals over the past 5–7 years, in parallel with the industry's high-profile breach history. The specific limit requirements vary by franchise and property type, but all large franchisors now require standalone cyber liability coverage as a condition of flag — not as an optional add-on. A cyber policy that was "good enough" at the prior renewal may fail a franchise audit at this renewal.
| Franchise Family | Typical Cyber Limit Requirement | Other Cyber-Related Terms |
|---|---|---|
| Marriott International (all brands) | $1M–$5M+ depending on brand tier and property size | Privacy and network security coverage, PCI fines coverage, A.M. Best A- VII+ carrier |
| Hilton (all brands) | $1M–$3M+ depending on brand tier | Regulatory defense, business interruption from cyber event, notification coverage |
| IHG Hotels & Resorts | $1M–$2M typical; higher for Intercontinental and Kimpton properties | Franchise named as additional insured where applicable; incident reporting to brand required |
| Wyndham Hotels & Resorts | $1M minimum for most brands, higher for upscale/full-service | PCI fines and assessments coverage increasingly explicit |
| Choice Hotels International | $1M typical | Business interruption, breach notification |
| Best Western Hotels & Resorts | $1M typical | Standard cyber suite required |
Requirements shown are illustrative based on typical franchise disclosure document (FDD) and brand standards we see in underwriting submissions. Actual requirements vary by specific franchise agreement, property type, amendment date, and brand tier — verify current requirements against your own franchise agreement and brand standards manual, which control.
Independent and boutique hotels do not have a franchise cyber mandate, but they face an arguably stronger commercial case for cyber coverage: independents typically lack the central incident response infrastructure that franchisors provide (24/7 breach hotlines, legal panels, PR support), so more of the breach response load falls on the hotel's own policy and vendor panel. The baseline recommendation for independent hotels of any meaningful size is the same $1M–$5M cyber limit, with particular attention to breach response panel quality and a pre-established relationship with the panel IR firm.
When the "cyber endorsement" was not actually cyber coverage
A 140-room select-service hotel came to us at renewal after a franchise compliance letter flagged the property's program as deficient in cyber coverage. The existing broker had placed a package program with a "cyber liability endorsement" on the BOP — sublimit of $100,000 aggregate, no cyber business interruption, no PCI fines coverage, no ransomware coverage, and a third-party privacy liability sublimit that shared limits with other GL-adjacent endorsements. The franchise required $2M standalone cyber, with privacy, network security, and PCI fines coverage, on an A.M. Best A- VII+ carrier.
The package endorsement was structurally incapable of meeting any of those requirements — not a matter of limit, but of coverage architecture. We moved the cyber coverage to a standalone hospitality-specialty cyber market at $3M limit with a $500K PCI sublimit, 8-hour cyber BI waiting period, ransomware and extortion coverage, and a pre-negotiated breach response panel including a hospitality-experienced IR firm. The standalone cyber cost $6,800/year — roughly $4,500/year more than the package endorsement — but satisfied the franchise requirement and, crucially, would actually respond to a PMS or POS breach. Within four months the hotel had a credential-stuffing attack on its loyalty portal; the panel's IR firm was engaged within 90 minutes, and total out-of-pocket cost to the hotel for response, notification, and credit monitoring for affected guests was under the policy's $25K retention.
Details anonymized and generalized to protect client confidentiality. Illustrative of a pattern we see regularly — package cyber endorsements are structurally different products from standalone cyber policies, and franchise compliance usually requires the latter.
Frequently asked questions about hotel cyber insurance
Cyber insurance is not required by state or federal law for hotels in the way that workers' compensation is, but it is effectively required in two practical senses. First, franchise agreements from all major families (Marriott, Hilton, IHG, Wyndham, Choice, Best Western) now require standalone cyber coverage of $1M–$5M+ as a condition of maintaining the franchise flag. Second, commercial lenders and lease requirements increasingly list cyber as a required coverage alongside property and liability. Even for independent hotels without a franchise or lender mandate, cyber is treated as a baseline coverage given the $3.36M average hospitality breach cost.
No. Standard ISO commercial general liability forms (CG 00 01) have expressly excluded access to or disclosure of confidential or personal information since 2014, through the ISO CG 21 06 endorsement family and updated core policy language. Standard commercial property policies cover physical property, not data, and standard property business interruption requires direct physical loss or damage to trigger — which a cyber attack generally does not cause. A cyber-specific policy (or a cyber section within a package program that meets cyber-specific coverage requirements) is the only form that responds to a hotel data breach.
A standalone cyber policy is a dedicated form with its own limits, its own set of first-party and third-party coverages, a dedicated breach response panel, and underwriting based on the hotel's actual IT controls. A cyber endorsement on a BOP or package is typically a narrow add-on with a low aggregate sublimit (often $50K–$250K), minimal first-party coverage, no dedicated breach response panel, and frequently no PCI fines or ransomware coverage. For any hotel above roughly 40–50 rooms, or any hotel that accepts cards at multiple POS points, the package endorsement is structurally insufficient and a standalone cyber policy is the appropriate form.
Franchise mandates almost always require a standalone cyber policy, not a package endorsement.
Standalone cyber insurance for a hotel typically costs $2,000–$50,000+ per year depending on property size, limit purchased, IT controls, loss history, and guest data volume. Rough benchmarks: a 30–60 room limited-service property with $1M limit and clean history typically pays $2,000–$5,000; a 60–120 room select-service property with $1M–$3M limit pays $4,000–$15,000; a 100–250 room full-service property with $3M–$5M limit pays $10,000–$30,000; a 250+ room resort with $5M–$10M+ limit pays $25,000–$50,000+. Credentials hygiene, MFA on admin accounts, network segmentation, and PCI attestation are the largest pricing levers.
The starting point is the franchise requirement, which is typically $1M–$5M depending on brand and property tier. For independent hotels, the baseline is also $1M–$5M for most properties, with $5M–$10M for larger full-service or resort properties and $10M+ for properties with large loyalty programs or significant EU guest exposure. The largest single cost category in an average hospitality breach is notification and credit monitoring for affected guests; a $1M limit can be exhausted by notification costs alone on a breach affecting 50,000–100,000+ guest records. Underwriting stress-test the limit against the total number of guest records stored, not against annual revenue.
Most hospitality-specialty cyber policies cover ransomware and cyber extortion — including ransom payments where legal and OFAC-compliant, ransomware negotiator fees, and recovery costs — subject to a sublimit and the insurer's requirement to use panel ransomware negotiators and OFAC screening. U.S. Treasury OFAC guidance requires that any ransom payment not be made to sanctioned entities or jurisdictions; insurers will decline coverage for payments that would violate OFAC. Some cyber policies have moved ransomware to a sublimit (often $500K–$1M) rather than full limit, so confirm both the presence of ransomware coverage and the applicable sublimit.
Cyber business interruption (also called network outage or system failure coverage) responds to lost net income and extra expense during an outage caused by a cyber event — ransomware, DDoS, system failure, or security breach. It is distinct from property business interruption, which requires direct physical loss or damage to covered property to trigger. A ransomware attack that shuts down a hotel's PMS and POS for 5 days does not cause physical damage and will not trigger property BI — only cyber BI responds. Key terms to check: waiting period (target 8–12 hours, not 24+), definition of outage (target partial degradation, not only full failure), and period of restoration (target 90–180+ days).
Yes. A cloud PMS shifts some of the infrastructure responsibility to the vendor, but it does not eliminate the hotel's exposure or its regulatory obligations. The hotel remains the data controller under most privacy laws, retains the PCI merchant responsibility, and remains responsible under franchise agreements and state breach notification statutes for data originating from its operations. A cloud PMS vendor breach is still the hotel's breach for notification and liability purposes, and most cyber policies will respond to a vendor-caused breach through their contingent/dependent business interruption and network security liability sections. Cloud PMS reduces some attack surfaces (physical server security, patching) but does not replace cyber insurance.
Cyber underwriters now routinely require a baseline of controls before offering terms: multi-factor authentication (MFA) on email, remote access, privileged accounts, and admin accounts; endpoint detection and response (EDR) on servers and critical workstations; documented backup procedures with offline or immutable backups; email security / phishing filtering; network segmentation separating PMS and PCI cardholder data environment from guest Wi-Fi and general office; PCI attestation of compliance; and an incident response plan. Missing MFA on admin access or missing EDR are the two most common reasons we see hotel cyber submissions get declined at renewal today, regardless of loss history.
Generally yes, for any guest whose personal information (as defined by that guest's state's breach notification statute) was exposed. All 50 U.S. states, D.C., Puerto Rico, Guam, and the U.S. Virgin Islands have breach notification statutes; hotels with a national guest base should expect multi-state notification obligations after any meaningful breach. Several states (California, New York, Oregon, Massachusetts, and others) additionally require notification to the state attorney general, and some require notification to consumer reporting agencies when the breach exceeds certain record thresholds. Cyber policy breach response coverage should include 50-state notification support and attorney general notification where applicable.
Call the cyber policy's 24/7 breach hotline first — before calling IT vendors, before informing the general manager, before any internal investigation. The breach response coordinator will connect you with panel IR forensic, legal, and PR resources immediately, and will help preserve evidence needed for both forensic analysis and insurance coverage. Parallel immediate steps: isolate affected systems if possible without destroying evidence, preserve logs, do not delete suspected malicious files or wipe systems, and begin an internal timeline log. Do not pay a ransomware demand before engaging the panel negotiator — OFAC compliance and policy coverage both depend on following the panel process.
Most hospitality-specialty cyber policies cover loyalty program attacks under a combination of privacy liability (guest PII exposed), funds transfer fraud or social engineering (stolen points redeemed fraudulently), and network security liability (underlying network compromise). Some generalist cyber policies have gaps — particularly around "digital assets" definitions that may not clearly include loyalty points with monetary value. For hotels with significant loyalty activity, confirm that stolen points are covered as a funds transfer / digital asset loss, and that account takeover (ATO) is within the policy's covered computer crime / social engineering triggers.
Not sure if your hotel's cyber coverage meets your franchise or PCI requirements?
Ask a question about PMS/POS breach exposure, franchise cyber mandates, PCI fines coverage, or cyber business interruption for your hotel.
Get a hospitality cyber coverage review for your hotel
We'll compare your current cyber program against your franchise requirements, PCI obligations, and realistic breach scenarios — and structure coverage that actually responds when a PMS, POS, or loyalty breach happens.