Omni Hotels Ransomware Attack

In late March 2024, Omni Hotels & Resorts suffered a ransomware attack that brought down their central reservation system, property management platforms, and electronic key card encoding systems. The attack forced all 50+ Omni properties to operate in manual mode. Guests were locked out of their rooms when electronic key cards failed to encode. The reservation system outage meant new bookings could not be processed. The attackers exfiltrated guest data including names, addresses, credit card information, and loyalty program details. The disruption lasted for several weeks.

Omni Hotels & Resorts is a privately held luxury hotel chain founded in 1958, operating over 50 properties throughout North America including hotels, resorts, and golf properties.

The ransomware targeted Omni's central property management system controlling reservations, billing, and room access across all properties. Attackers gained access through a compromised VPN account with elevated privileges. The encryption affected both production systems and backup servers.

Professional ransomware group with focus on hospitality sector. Demonstrated patience in network reconnaissance before deploying encryption across all systems including backups.

Attribution sources

• BleepingComputer
• Media reports

Countries affected

• United States
• Canada

Data types

• Guest names
• Addresses
• Phone numbers
• Email addresses
• Credit card numbers
• Loyalty program details
• Reservation histories

Revenue losses from inability to process reservations for weeks. IT remediation costs. Legal exposure from guest data compromise.

Public reaction

Widespread frustration among guests unable to check in, check out, or access their rooms. Media coverage highlighted hotel chain operating with pen and paper.

Political impact

Industry-wide reviews of hospitality cybersecurity practices.

Potential class-action lawsuits from affected guests. State attorney general investigations.

Civil lawsuits

• Potential class-action for guest data compromise

Policy changes

• Hospitality industry cybersecurity guidelines strengthened

Security improvements

• Network segmentation between property management and corporate systems
• Enhanced backup protection including offline and immutable backups
• Mandatory MFA for all remote access

Significance

Demonstrated the catastrophic operational impact of ransomware on the hospitality industry, where digital systems control everything from room access to payments.

Legacy

Omni Hotels became a textbook example of ransomware operational disruption in hospitality, driving industry-wide adoption of offline backups.

Publishing organisations

• BleepingComputer

Systems restored over 4-6 weeks. Guest notification completed. Credit monitoring offered.

References

1. [1]BleepingComputer: Omni Hotels ransomware attack
2. [2]Hospitality Tech: Omni breach analysis