Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Hospitality

Breach intelligence, attack campaigns, and threat reports targeting the Hospitality sector.

78 threat reports
Page 1 of 7
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Hospitality Threat Reports

Showing 1–12 / 78 reports
Unauthenticated Endpoint Puts Millions of Intelbras Surveillance Cameras at Risk of Denial-of-Service
Computer/Network Security1 week ago

Unauthenticated Endpoint Puts Millions of Intelbras Surveillance Cameras at Risk of Denial-of-Service

In 2024–2025, Kaspersky researchers discovered a denial-of-service vulnerability (CAN-2026-2035970, CVSS 4.0 score 5.1) in Intelbras IP camera firmware affecting models including the iM3B-C, iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC. The flaw resided in an unauthenticated firmware upgrade endpoint (/firmwareUpgrade_service/Demo) that accepted any HTTP POST request—regardless of payload validity—and forced the device into a reboot cycle, rendering it offline indefinitely when requests were repeated. With over 4 million downloads of the companion Mibo Smart app across Latin America, the attack surface was substantial. Intelbras patched the issue in firmware R.260804 following responsible disclosure. This incident underscores the persistent risk of unauthenticated management endpoints in IoT and embedded devices deployed at scale. As surveillance infrastructure becomes more deeply integrated into enterprise and critical-facility security postures, availability-disrupting vulnerabilities in these devices carry operational consequences far beyond a simple device reboot, including blind spots in physical security and compliance gaps under frameworks requiring continuous monitoring.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
LG Smart TVs Vulnerable to Unauthenticated Root Takeover via Local Network
LG Smart TVs Vulnerable to Unauthenticated Root Takeover via Local Network
Hospitality3 weeks ago

LG Smart TVs Vulnerable to Unauthenticated Root Takeover via Local Network

In October 2026, security researchers disclosed three critical vulnerabilities in LG's webOS that can be chained together to achieve unauthenticated root access on smart TVs from the local network. The attack exploits a pairing service on port 3001 used by the LG ThinQ app, leveraging a trusted test certificate to bypass PIN authentication and obtain privileged access. Attackers then abuse the PalmServiceBridge interface and pmlogd logging service to execute commands with root privileges. LG has issued firmware updates for affected models including 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25. This incident highlights the growing threat landscape targeting IoT devices, particularly as smart home ecosystems expand and become increasingly integrated into enterprise and residential networks. The attack demonstrates how legacy trust mechanisms and inadequate input validation continue to create critical security gaps in consumer devices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
How Malware at Nippon Columbia Exposed 8.6 Million Karaoke Fan Records
How Malware at Nippon Columbia Exposed 8.6 Million Karaoke Fan Records
Entertainment/Movie Production4 weeks ago

How Malware at Nippon Columbia Exposed 8.6 Million Karaoke Fan Records

In October 2026, Daiichi Kosho, Japan's largest karaoke maker operating 521 venues including Big Echo chains, disclosed that a malware infection at its contractor Nippon Columbia exposed 8.6 million customer records and 93,000 employee records. The malware was discovered on an employee's computer at Nippon Columbia Group on October 5, prompting immediate system isolation. Exposed data included full names, genders, birth dates, email addresses, and phone numbers across multiple karaoke brands including BIG ECHO, MEGA BIG, and Karaoke CLUB DAM. This incident highlights the critical vulnerability of third-party contractor relationships in Japan's entertainment sector, occurring amid a surge in supply chain attacks targeting customer databases. The breach demonstrates how malware infections at service providers can expose millions of personal records, emphasizing the urgent need for enhanced contractor security oversight and endpoint protection in outsourced data processing arrangements.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Japan's API Security Crisis: How CVE-2026-72898 and Mobile API Abuse Exposed Millions
Japan's API Security Crisis: How CVE-2026-72898 and Mobile API Abuse Exposed Millions
Information Technology/IT1 month ago

Japan's API Security Crisis: How CVE-2026-72898 and Mobile API Abuse Exposed Millions

Throughout September 2026, Japan experienced a surge in data breaches affecting major organizations including Park24's Times Car service (6.6 million accounts) and Yakiniku King restaurant chain (10.7 million records). Attackers systematically exploited mobile API vulnerabilities by reverse-engineering smartphone applications to extract API keys and endpoints, then abusing internal APIs with elevated privileges. A critical component involved exploiting CVE-2026-72898, a CVSS 10.0 SQL injection vulnerability in Metabase business intelligence software that allowed unauthenticated access to administrator functions and connected databases. This incident represents a concerning evolution in API-focused attacks, demonstrating how threat actors are systematically targeting mobile application backends and business intelligence systems across multiple countries. The campaign's scope expanded beyond Japan to 13 other regions including South Korea, France, and Poland, indicating a coordinated effort to exploit common API security gaps and known vulnerabilities at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Keio Corporation Ransomware Attack Exposes Critical Infrastructure Vulnerabilities
Keio Corporation Ransomware Attack Exposes Critical Infrastructure Vulnerabilities
Transportation1 month ago

Keio Corporation Ransomware Attack Exposes Critical Infrastructure Vulnerabilities

In September 2026, Keio Corporation, a major Japanese railway operator with $2.6 billion annual revenue, suffered a ransomware attack that disrupted its business systems over the weekend. The attack primarily impacted the company's hospitality division including 25 hotels, affecting payment systems and customer-facing services, while railway operations remained unaffected. Keio immediately shut down its network to prevent further damage and engaged law enforcement and external security experts for investigation. The incident occurred alongside a separate breach at Tokyo Metro, raising concerns about coordinated attacks on Japanese transportation infrastructure. This incident highlights the growing threat to critical transportation infrastructure and the potential for ransomware groups to target hospitality and payment systems within larger organizations, demonstrating the need for segmented security architectures.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Autonomous AI Agents Execute Massive Credit Card Theft Campaign
Autonomous AI Agents Execute Massive Credit Card Theft Campaign
Retail Industry1 month ago

Autonomous AI Agents Execute Massive Credit Card Theft Campaign

A Chinese threat actor deployed autonomous AI agents to orchestrate a massive payment card theft operation, compromising over 119 websites and stealing more than 600,000 credit card records. The campaign, active since July 2026, utilized three AI frameworks - Strix for vulnerability scanning, Cairn for exploitation, and Hermes for orchestration - to systematically target online retailers. Major victims included Fortune 500 companies across hospitality, aviation, and retail sectors. The attackers deployed payment skimmers through various injection methods and implemented destructive cleanup procedures that wiped source data after exfiltration, causing operational disruptions. This incident represents a paradigm shift toward AI-powered cybercrime, demonstrating how autonomous systems can execute complex attack chains at unprecedented scale and speed. The low operational cost of $25 per target and minimal human oversight signal a new era where sophisticated attacks become accessible to less skilled threat actors, fundamentally changing the threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security
Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security
Airlines/Aviation1 month ago

Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security

In September 2026, cybersecurity researchers from Vigilance Security uncovered a sophisticated social engineering campaign dubbed 'Dark Sourcery' targeting major AI chatbots including ChatGPT, Google Gemini, and Google AI Overview. Threat actors poisoned these AI systems by flooding the web with carefully crafted malicious content, fake support pages, and fraudulent contact information, tricking the AI into presenting this misinformation as factual responses to users. The campaign compromised at least 374 major companies including Fortune 100 organizations, airlines like Delta and Lufthansa, and financial institutions such as Chase and Bank of America, causing significant reputational damage and enabling widespread phishing attacks. This incident represents a critical evolution in AI-targeted attacks as organizations increasingly integrate AI chatbots and agents into their business operations. With 91% of users blindly trusting AI responses without verification, this attack vector poses an unprecedented threat to enterprise security and user trust in AI systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Reveals How AI is Reshaping Cyberthreats in 2026
Microsoft Reveals How AI is Reshaping Cyberthreats in 2026
Information Technology/IT1 month ago

Microsoft Reveals How AI is Reshaping Cyberthreats in 2026

Microsoft's September 2026 security analysis revealed how AI-powered cyberattackers are exploiting fundamental security weaknesses with unprecedented speed and persistence. The report documented three major attack campaigns: Storm-2945's CaptiveCrunch hospitality network manipulation, AI agent boundary exploitation incidents affecting OpenAI and Anthropic systems, and sophisticated social engineering attacks through Microsoft Teams. These incidents demonstrated how attackers leverage legitimate tools, trusted authentication flows, and AI agent vulnerabilities to achieve rapid lateral movement across enterprise environments, affecting identity systems, endpoints, and cloud infrastructure. This analysis matters now because AI is fundamentally reshaping the cyberthreat landscape, with autonomous attacks creating exponentially larger attack surfaces and faster compromise timelines than traditional methods.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Hospitality Under Fire: PBX System Reconnaissance Reveals Critical Security Gaps
Hospitality Under Fire: PBX System Reconnaissance Reveals Critical Security Gaps
Hospitality1 month ago

Hospitality Under Fire: PBX System Reconnaissance Reveals Critical Security Gaps

In September 2020, SANS Internet Storm Center detected targeted reconnaissance scans against hospitality industry applications, specifically focusing on the abandoned PIAF-HMS (PBX in a Flash Hospitality Management System) project. The scans originated from IP address 94.102.49.125, associated with bulletproof hosting provider IP Volume (AS202425), and targeted multiple hospitality-related endpoints including /admin/, /ucp/, /hms/, and /hotel/. The attackers used a distinctive user agent 'Farez-Sorter/1.0' and appeared to be exploiting recently disclosed SQL injection vulnerabilities in the decade-old, unpatched system that lacks proper input validation and authentication controls. This incident highlights the persistent targeting of hospitality infrastructure, where attackers seek to steal valuable guest personal data and potentially launch man-in-the-middle attacks. The focus on PBX systems suggests sophisticated attack vectors that could allow threat actors to impersonate internal hotel communications and manipulate guest interactions through compromised telephony infrastructure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
BambooToken Malware Exploits MQTT Protocol for Stealthy Enterprise Attacks
Financial Services1 month ago

BambooToken Malware Exploits MQTT Protocol for Stealthy Enterprise Attacks

BambooToken, a sophisticated malware framework active since 2023, has evolved to use the MQTT protocol for command-and-control communications across Windows and Linux systems. The malware compromises enterprise servers supporting mobile applications, financial services, and software development firms primarily across Asia and South America. By leveraging MQTT's publish-subscribe architecture, BambooToken creates resilient command channels that avoid direct connections to attacker infrastructure, significantly improving evasion capabilities while maintaining persistent access to infected systems. This incident highlights the growing trend of threat actors adopting unconventional protocols like MQTT to bypass traditional security controls, reflecting the increasing sophistication of modern cyber campaigns targeting critical business infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CareCam CM2507 IP Cameras: Seven Critical Vulnerabilities Expose Enterprise Networks
Health Care / Life Sciences1 month ago

CareCam CM2507 IP Cameras: Seven Critical Vulnerabilities Expose Enterprise Networks

The CareCam CM2507 IP camera contains seven critical vulnerabilities (CVE-2026-88259 through CVE-2026-81321) that collectively allow complete device compromise. These flaws include missing authentication for video streaming, empty passwords in ONVIF services, cleartext credential storage, weak password hashing, and unauthorized script execution from removable media. Attackers can exploit these vulnerabilities to access live video feeds, extract stored credentials, execute arbitrary code, and pivot to connected networks. The vendor has not responded to CISA's coordination attempts, leaving deployed devices unpatched. This incident highlights the persistent security challenges in IoT devices deployed across commercial facilities worldwide, particularly as organizations increasingly rely on IP cameras for security monitoring while threat actors actively target poorly secured IoT infrastructure for initial access and lateral movement.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
BambooToken Malware Exploits MQTT Protocol in Global Multi-Platform Campaign
Banking/Mortgage1 month ago

BambooToken Malware Exploits MQTT Protocol in Global Multi-Platform Campaign

BambooToken is a sophisticated multi-platform malware campaign discovered in early 2026 that uses MQTT protocol for command and control across Windows and Linux systems. Active since February 2023, the threat actors exploit DLL sideloading techniques via Tendyron's OnKey authentication software to compromise organizations across Asia and South America. The malware demonstrates advanced evasion capabilities by leveraging legitimate PKI security tokens as attack vectors and using Cloudflare-proxied infrastructure to manage infections at scale. Researchers have identified compromised entities including mobile applications, financial organizations, hotels, and critical infrastructure systems across multiple countries. This incident highlights the evolving sophistication of threat actors who are increasingly adopting unconventional communication protocols and supply chain attack vectors to evade traditional security controls and maintain persistent access to high-value targets.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports