Tech Talk

Recent posts

Think about the moment when you first enter your hotel room. Look around: Does the room tell you anything unique about the hotel where you are staying? Or is it all beige walls and double beds with white covers, and you have to walk back outside and look at the sign on the hotel’s facade to even remember where you are?

Hotel guests commonly bring multiple devices with them during their stay. However, many hotel environments don’t provide easy access to charging outlets. This situation can lead to a guest feeling more than inconvenienced. A recent survey found almost 90 percent of people "felt panic" when their phone battery dropped to 20 percent or below.

Spam is one of the major problems that most hotel website owners face on regular basis. It is a bad practice used by spammers to persuade the page rank of a site.

GBTA recently partnered with AccorHotels to conduct a study investigating the role of loyalty in managed travel programs in Europe with the goal of understanding how loyalty programs currently fit within company travel policy and what opportunities may exist in the future.

People today expect to be connected always and everywhere; sometimes it’s hard to believe that there was a world before smartphones and Wi-Fi. In the time since Wi-Fi became ubiquitous in hotels, apartments, and public spaces, it has fueled the evolution of connectivity in a lot of ways. Just like Maslow’s hierarchy of needs, the most basic needs start at the bottom, and you can’t get to the next level without a strong foundation. 



want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.

x
 

The Equifax Breach: Takeaways for Hospitality Companies

10/17/2017


No single company buys enough insurance limits to have such a major impact that the prices go up or capacity falls away immediately following an event. A systemic loss, like one that impacts the power grid or halts the financial sector from trading for a few days, would be an entirely different (and scary) story. But this breach is still stacking up to be different from other recent mega breaches, and should serve as a wakeup call to those organizations that still think this isn’t going to happen to them, or that this is an IT risk and therefore not an issue for us non-IT folks to worry about. McGriff recently published a white paper about the specifics of the insurance response and the importance of preparation, business continuity planning.
 
This could lead to a new path for plaintiffs to the directors and officers (D&O) insurance. More than 90 law suits were filed in the first two weeks (some of them for the stock drop, but most of them for privacy-related damages and expenses which would include negligence, breach of contract, etc.). Until now, there have been cases against companies and their directors and officers brought by shareholders following a breach (tag-along suits) but none of them has prevailed (as far as I’m aware) given that the business judgement rule has generally provided a solid defense. In this case, it may appear that the directors and officers did not do what prudent people in their position would do, given the kind of information they hold, and the fact that senior management was allowed to sell shares of company stock after the breach was discovered internally but before it was made public. Time will tell, but we could be looking at a limits loss on the E&O/information security insurance tower and on the D&O tower. D&O underwriters have already started to ask more and tougher questions of their buyers around their risk management and readiness to handle the backlash of a major breach. 
 
This loss, coupled with recent natural catastrophes affecting the overall reinsurance market (insurance behind the insurers) may force a move back toward more rigorous underwriting. In the past two years, the insurance markets that write the E&O/cyber for companies like Equifax have become increasingly lax regarding the security/underwriting requirements they place on these companies due to competitive market pressure brought on by increased capacity (more capacity/supply = lower cost and better coverage). For hoteliers this means underwriting beyond a questionnaire about IT security and business continuity plans (more than just –do you have one?) and looking past “compliance” around the acceptance of credit cards. Another thing that most certainly will change is how much scrutiny there is on third-party service providers that hold, process or aggregate data and/or provide critical services, such as cloud providers or other third parties that handle reservations on your behalf. What kind of coverage is in your policy now for a breach caused by such third parties (on the liability side and on the first party side), and what do your contracts with those vendors say? Absent the insurance, vendors should be accountable for your costs that result from a breach, but generally they do not fully accept that risk, which is a major issue (and one that could be the subject of an article on its own).
 
Something else to consider: does your company want to manage the customer message and control the response if there is a major issue, or do you want to lay that off to the at-fault third party? Hint: you may want to handle the response internally, hire the forensics, legal and PR help you need, and then worry about subrogation/expense recovery later because your vendors are never going to care as much about your brand as you do. Whatever you decide is right for your company, make sure both your vendor contracts and your insurance track with that decision. Do you have your breach response providers vetted, under contract (retainer maybe?) and approved by the insurance carriers already? The whole issue surrounding who handles what following a breach becomes more complicated when you own, but do not manage your properties (or the other way around). Even more complex, if you have a franchise model where the franchisees are intended to be kept at arms’ length, yet the franchisor chooses to direct or control franchisee information security in order to better protect their brand. Even though each franchisee may have its own MSA with the card brands, there may be a very blurred line around who takes on what risk and responsibility unless it is explicitly agreed upon up front.
 
The insurance markets have become more willing to give control of the breach response to the insured in recent months, and they have more heavily relied on compliance with various information security standards such as PCI DSS as a means of underwriting. However, my suspicion is that markets will start to swing back the other way. Having a broker and outside privacy counsel that are specialists in this market is paramount to getting the best results for your company in what is sure to be a volatile several months.
About The Author
Mary Guzman
Director, E&O and InfoSec Strategy and Sales
McGriff, Seibels & Williams
Financial Services Division


Mary Guzman is the director, E&O and InfoSec Strategy and Sales with McGriff, Seibels & Williams – Financial Services Division. She was also a speaker at the 2017 CIO Summit where she discussed cybersecurity considerations. Mary can be reached at MGuzman@McGriff.com.

 
Comments
Blog post currently doesn't have any comments.
Leave comment



 Security code