ReliaQuest Warns of Rising Credential Attacks Across Hospitality
Summary
ReliaQuest says hospitality-targeting attacks rose 30% in Q3 2026 as password spraying, brute force, and phishing remained prominent. It recommends phishing-resistant MFA, access monitoring, infrastructure hardening, and faster response.
Key points
- ReliaQuest reports that 101 organizations were named on data-leak sites in Q3 2026, an 11% increase from the previous quarter; attacks targeting hospitality rose 30%.
- Password spraying accounted for 21% of observed techniques, brute force 13%, and spearphishing links 9%; phishing was 19% overall.
- The article says Qilin, The Gentlemen, and Inc Ransom remained active against hospitality, with new activity from Settra.
- GreyMatter Digital Risk Protection data showed impersonating domains rising and unauthorized goods listings becoming a leading concern, while credential exposures declined as a share of alerts.
- Recommended measures include phishing-resistant MFA, monitoring for suspicious login activity, reviewing exposed remote-access and property systems, and feeding brand-abuse signals into SOC investigations.
- ReliaQuest reports mean time to contain fell 73%; organizations using Automated Response Playbooks contained threats in an average of four minutes.
Article Details
- Defense Focus
- Protect hospitality access paths by detecting credential attacks, suspicious access, and brand impersonation, then containing threats quickly across distributed operations.
- Detection Methods
- Monitor for password spraying and brute-force activity.
- Monitor for new devices and unusual login patterns.
- Treat fake domains, unauthorized listings, and impersonated booking pages as threat-intelligence signals and feed them into the SOC.
- Monitor APIs for suspicious activity.
- Use external exposures, including leaked credentials, open ports, expired certificates, and lookalike domains, to trigger internal investigations and increased monitoring of related assets.
- Data Sources
- Authentication and login activity
- Device and sign-in pattern data
- API activity
- External brand-risk and impersonation findings
- Leaked credentials, open ports, expired certificates, and lookalike-domain exposures
- Telemetry across tools, including data at source, in storage, and in transit
- Defensive Actions
- Enforce phishing-resistant MFA for critical users.
- Prioritize protection of booking platforms, loyalty portals, and employee remote access.
- Review exposure across SD-WAN, SharePoint, remote access, and property management systems.
- Restrict administrative privileges and prioritize patching based on exploitability.
- Tailor response plans to decentralized operations, seasonal teams, and third parties.
- Automate low-risk containment and route actions that may disrupt operations to a human operator.
- Use automated response playbooks to accelerate containment.
MITRE ATT&CK
T1110.001 · Password GuessingThe article reports brute-force activity as an observed technique and recommends monitoring for it.T1110.003 · Password SprayingThe article reports password spraying as an observed technique against the sector and recommends monitoring for it.T1566.002 · Spearphishing LinkSpearphishing links are reported among the observed techniques, and the article describes phishing links as a way attackers target hospitality users.
Threat Actors
INC RansomThe article reports that Inc Ransom remained active against the hospitality sector.QilinThe article reports that Qilin remained active against the hospitality sector.SettraThe article reports new activity from Settra in the sector, describing it as part of activity by operators testing hospitality for weak access points.The GentlemenThe article reports that The Gentlemen remained active against the hospitality sector.
Vendors
Products
GreyMatterGreyMatter Digital Risk Protection data also showed a shift outside the perimeter. Credential exposures declined as a share of alerts, but impersonating domains rose and unauthorized goods listings surged into a leadingMicrosoft SharePointHarden location infrastructure: Review exposure across SD-WAN, SharePoint, remote access, and property management systems.
Industries
EntertainmentFor hospitality and entertainment, the message is clear: protect the experience by protecting access. Attackers are moving through credentials, exposed systems, and brand abuse. Defense has to move faster across allHospitalityHospitality organizations are built around access. Guests book rooms, join loyalty programs, connect to Wi-Fi, and interact with staff across many locations.