Hospitality
8 organizations, 19 confirmed incidents.
Hospitality covers hotels, restaurants, and travel and events companies that hold guest reservation, loyalty-program and payment-card data, often collected through a mix of the operator's own systems and third-party booking platforms. There is no hospitality-specific federal breach-notification law; an incident here is reported under the general state or national data-breach notification statute covering the guests affected, and any exposed payment-card data separately triggers a contractual notification to the card networks under PCI DSS rather than a statutory one.
Incidents by year
| Year | Confirmed incidents |
|---|---|
| 2026 | 7 |
| 2025 | 2 |
| 2023 | 4 |
| 2020 | 2 |
| 2019 | 1 |
| 2018 | 1 |
| 2017 | 1 |
| 2016 | 1 |
Top organizations by confirmed incidents
Questions and answers
How many confirmed incidents involve Hospitality organizations on Breach Census?
19 confirmed incidents across 8 organizations in the Hospitality sector are recorded on Breach Census.
Which year had the most confirmed Hospitality incidents?
2026, with 7 confirmed incidents, the most of any year on record for this sector.
Which attack types are most common in the Hospitality sector?
Among Hospitality sector incidents that carry an attack-type classification, the most common are Hacking/IT Incident, Data Interception, Malware Deployment.
What counts as a confirmed incident for the Hospitality sector?
An incident counts here once its primary organization carries the Hospitality sector label and the incident itself has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.