Tech Talk

Recent posts

People today expect to be connected always and everywhere; sometimes it’s hard to believe that there was a world before smartphones and Wi-Fi. In the time since Wi-Fi became ubiquitous in hotels, apartments, and public spaces, it has fueled the evolution of connectivity in a lot of ways. Just like Maslow’s hierarchy of needs, the most basic needs start at the bottom, and you can’t get to the next level without a strong foundation. 

By now, everyone is aware that hotel giant Marriott International announced on Friday a massive data breach that goes back more than four years and may have affected up to 500 million customers worldwide. 

After two years of preparation, the FlyZoo Hotel — a futuristic property that uses interactive technologies to do everything from greet guests to deliver room service — is ready for business. 

Mobile technology is fast becoming central to the entire travel experience. Consumers are increasingly using their smartphones to research trips, book accommodation, check in at the airport, and access their hotel room. But one of the next big roles mobile has to play in the travel process is mobile payment. The idea of an entirely cashless society might still seem some way off, but mobile payment is gaining popularity. As it becomes more widely used, its fast and frictionless nature will bring benefits before, during and after a trip. 

Digital marketing, also known as internet marketing, plays a significant role to boost hotel website traffic and online bookings. Recently, many big announcements were made in the digital industry, for example when Facebook introduced a new video format for marketers, or when Google announced a board core algorithm. If you are a new hotelier and want to stay ahead in the industry, then you should know what’s going on in the hotel digital marketing industry. 
 



want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.

x
 

The Equifax Breach: Takeaways for Hospitality Companies

10/17/2017


No single company buys enough insurance limits to have such a major impact that the prices go up or capacity falls away immediately following an event. A systemic loss, like one that impacts the power grid or halts the financial sector from trading for a few days, would be an entirely different (and scary) story. But this breach is still stacking up to be different from other recent mega breaches, and should serve as a wakeup call to those organizations that still think this isn’t going to happen to them, or that this is an IT risk and therefore not an issue for us non-IT folks to worry about. McGriff recently published a white paper about the specifics of the insurance response and the importance of preparation, business continuity planning.
 
This could lead to a new path for plaintiffs to the directors and officers (D&O) insurance. More than 90 law suits were filed in the first two weeks (some of them for the stock drop, but most of them for privacy-related damages and expenses which would include negligence, breach of contract, etc.). Until now, there have been cases against companies and their directors and officers brought by shareholders following a breach (tag-along suits) but none of them has prevailed (as far as I’m aware) given that the business judgement rule has generally provided a solid defense. In this case, it may appear that the directors and officers did not do what prudent people in their position would do, given the kind of information they hold, and the fact that senior management was allowed to sell shares of company stock after the breach was discovered internally but before it was made public. Time will tell, but we could be looking at a limits loss on the E&O/information security insurance tower and on the D&O tower. D&O underwriters have already started to ask more and tougher questions of their buyers around their risk management and readiness to handle the backlash of a major breach. 
 
This loss, coupled with recent natural catastrophes affecting the overall reinsurance market (insurance behind the insurers) may force a move back toward more rigorous underwriting. In the past two years, the insurance markets that write the E&O/cyber for companies like Equifax have become increasingly lax regarding the security/underwriting requirements they place on these companies due to competitive market pressure brought on by increased capacity (more capacity/supply = lower cost and better coverage). For hoteliers this means underwriting beyond a questionnaire about IT security and business continuity plans (more than just –do you have one?) and looking past “compliance” around the acceptance of credit cards. Another thing that most certainly will change is how much scrutiny there is on third-party service providers that hold, process or aggregate data and/or provide critical services, such as cloud providers or other third parties that handle reservations on your behalf. What kind of coverage is in your policy now for a breach caused by such third parties (on the liability side and on the first party side), and what do your contracts with those vendors say? Absent the insurance, vendors should be accountable for your costs that result from a breach, but generally they do not fully accept that risk, which is a major issue (and one that could be the subject of an article on its own).
 
Something else to consider: does your company want to manage the customer message and control the response if there is a major issue, or do you want to lay that off to the at-fault third party? Hint: you may want to handle the response internally, hire the forensics, legal and PR help you need, and then worry about subrogation/expense recovery later because your vendors are never going to care as much about your brand as you do. Whatever you decide is right for your company, make sure both your vendor contracts and your insurance track with that decision. Do you have your breach response providers vetted, under contract (retainer maybe?) and approved by the insurance carriers already? The whole issue surrounding who handles what following a breach becomes more complicated when you own, but do not manage your properties (or the other way around). Even more complex, if you have a franchise model where the franchisees are intended to be kept at arms’ length, yet the franchisor chooses to direct or control franchisee information security in order to better protect their brand. Even though each franchisee may have its own MSA with the card brands, there may be a very blurred line around who takes on what risk and responsibility unless it is explicitly agreed upon up front.
 
The insurance markets have become more willing to give control of the breach response to the insured in recent months, and they have more heavily relied on compliance with various information security standards such as PCI DSS as a means of underwriting. However, my suspicion is that markets will start to swing back the other way. Having a broker and outside privacy counsel that are specialists in this market is paramount to getting the best results for your company in what is sure to be a volatile several months.
About The Author
Mary Guzman
Director, E&O and InfoSec Strategy and Sales
McGriff, Seibels & Williams
Financial Services Division


Mary Guzman is the director, E&O and InfoSec Strategy and Sales with McGriff, Seibels & Williams – Financial Services Division. She was also a speaker at the 2017 CIO Summit where she discussed cybersecurity considerations. Mary can be reached at MGuzman@McGriff.com.

 
Comments
Blog post currently doesn't have any comments.
Leave comment



 Security code