Hotel guest data security: encrypted email and a protected vault

Guest data security in hotels: encrypted email and a vault for card numbers and passports

It is 7:40 a.m., morning shift. An email lands in the front desk's info@ inbox, apparently from Booking.com: a guest is disputing a double charge, the reservation number is there, the dates are right. To check it, you copy a link and clear a CAPTCHA. The CAPTCHA asks you to open a Windows dialog and paste a command. The receptionist does it, because it looks like a security step.

This is not hypothetical. It is the ClickFix technique that Microsoft attributes to the group Storm-1865, used for months against staff at Booking.com partner hotels. On April 13, 2026, Booking.com began notifying customers that unauthorized third parties had accessed reservation data: names, emails, addresses, phone numbers. Enough to write to a guest in the hotel's name and ask them to "verify" their card.

In Italy the same entry point produced a different kind of damage. On August 6, 2025, CERT-AGID reported that tens of thousands of scanned ID documents taken from Italian hotels were on sale on a dark web forum: three properties in the first advisory, around a dozen by the updates that followed over the next week. Two different incidents, one shared trait: the guest's most sensitive data was stored in the clear, within reach of anyone who got into the systems.

Key takeaways

• In hotels, a guest's most sensitive data (card numbers, passports, rooming lists, health information) arrives almost entirely by email and stays in the clear as attachments in a shared mailbox.
• PCI DSS v4 requirement 4.2.2 calls for strong cryptography on the card number whenever it travels through end-user messaging technologies. TLS between mail servers does not satisfy it.
• Italy's data protection authority, the Garante, requires the copy of an ID document to be deleted as soon as the Alloggiati Web receipt has been issued, including copies received by email.
• NIS2 does not list hospitality, yet it reaches hotels through corporate contracts: a third party was involved in 48% of the breaches analyzed in the Verizon DBIR 2026.
• EmailGrant, the secure messaging extension of FileGrant, the file-centric platform from CyberGrant, sends the hotel's sensitive correspondence encrypted, revocable and with an expiry date, while FileGrant keeps passports and card authorization forms in a vault with quantum-safe encryption, role-based access and a full audit trail.

What is actually sitting in a hotel's info@ inbox?

Anyone who has worked in a hotel knows. The agency sending the authorization form with a card number to guarantee a booking. The tour operator sending a rooming list for a group, with forty scanned passports. The corporate client attaching travel documents for its employees. The guest describing allergies or accessibility needs, which is health data under Article 9 of the GDPR.

On top of that sits the operational correspondence: allotment contracts, confidential corporate rates, reports from the external revenue manager, supplier invoices. Material worth little to the guest and a great deal to a competitor, or to someone preparing invoice fraud.

The problem is not the channel. It is persistence. Attachments pile up for years, the mailbox is shared across front desk, reservations and management, the password is often the same for every shift and outlives seasonal contracts. Anyone who gets into that mailbox, through phishing or through a credential that was never revoked, finds an archive already sorted by date.

What do PCI DSS and the Garante require for guest data?

On cards the rule is explicit. PCI DSS v4 requirement 4.2.2 states that the primary account number (PAN), when it travels over end-user messaging technologies such as email and chat, must be protected with strong cryptography. TLS between mail servers protects the transport and stops there: the message that stays readable in the mailbox is not covered. One clear-text card form among the attachments pulls the entire mail infrastructure into PCI scope.

On identity documents the Garante, in its note of April 29, 2026 to industry associations, confirmed that the copy exists only to enter the data into Alloggiati Web, the Italian State Police portal, and must be deleted once the receipt is issued. The rule applies to the scan that arrived by email too, which almost no property deletes.

This is the blind spot. Firewalls, antivirus and spam filters guard the way into the mailbox. None of those controls governs what happens to the file afterwards: who opens it, how long it stays readable, where it gets forwarded. The IBM Cost of a Data Breach Report 2026 puts a price on that gap: only 37% of breached organizations encrypted sensitive data at rest and in transit, and where encryption was in place the average cost of a breach fell by $213,478.

Does NIS2 apply to hotels?

Legislative Decree 138/2024, Italy's implementation of NIS2, does not list hospitality among essential or important entities. Many hotel groups concluded that NIS2 was not their problem. That reading holds up less and less.

In-scope entities have to assess the risk of every supply relationship, including a supplier's access to their data, and turn security measures into contract clauses, incident notification duties and audit rights that get verified over time. Airlines, rail operators, banks, insurers and large manufacturers are all in scope, and all of them send hotels data about their passengers, customers and employees. The Verizon DBIR 2026 shows the scale: breaches involving a third party grew 60% in a year and now account for 48% of the total.

So NIS2 arrives at the front desk through the corporate contract or the tour operator renewal: a security questionnaire, a requirement to notify incidents within 24 hours, a question about how received data is protected. Answering "we use a shared mailbox with spam filtering" now costs a supplier its place on the buyer's list.

How do EmailGrant and FileGrant protect guest data?

The question worth asking is not how to harden info@. It is why a passport and a card number should ever sit unencrypted inside a mailbox. Protection is applied to the file at birth and travels with it: that is the file-centric approach CyberGrant built FileGrant and its extensions on.

EmailGrant: sensitive correspondence travels encrypted

EmailGrant is the extension that brings FileGrant's protection to email. It is not another client to install. It is an encrypted messaging channel staff use whenever a message carries data that should not sit in the clear: the confirmation with guarantee details, the document request to a group leader, the agency contract. Messages never transit external servers and stay encrypted inside the platform.

• Revoke after sending: wrong recipient, or the relationship has ended, and the message closes with one click.
• Scheduled expiry: the email carrying card details stops being readable on the date you set, for example the day after check-out.
• Tracking: who opened it, when, from which IP address.
• External recipients with no account (guest, agency, tour operator) get in with a one-time code.
• Attachments inherit FileGrant's classification and permissions.

FileGrant: passports and card forms in a vault

FileGrant is the platform the extension sits on. Passports, card authorization forms and rooming lists stop living as attachments and move into a vault, encrypted with the NIST post-quantum standard CRYSTALS-Kyber, applied through the patented Lock&Go technology. Private AI, which sends nothing to public clouds, recognizes the document and applies the right tag automatically (identity, financial, health) along with the restrictions attached to it.

• Role-based access (RBAC): the front desk sees the document for the length of check-in, the revenue manager sees the rates, housekeeping sees none of it.
• Blocking of download, printing and screen capture on identity documents.
• An audit trail on every file: who opened what and when, exportable for a corporate client's audit or for the 72-hour notification to the Garante.
• Controlled deletion of the document copy once the Alloggiati Web receipt is in, as the Garante requires.
• Revocable sharing with suppliers: even a file already downloaded, in the encrypted Lock&Go format, stays readable only to whoever still holds permission.

How does it fit with existing email, SSO and the PMS?

For the CIO and the CTO, deployment matters as much as the feature list. FileGrant runs on-premises on the group's own servers, with private master keys, or in cloud within national borders. It supports SSO with Microsoft and Google, so it sits alongside the existing mailbox and PMS rather than replacing them.

How do three typical workflows change?

Five questions for a CISO before choosing

Before evaluating any solution, it is worth taking stock of where you stand. These five questions measure how exposed the group is today and what to ask a security vendor.

1. How many messages holding card numbers or identity documents are readable right now in shared mailboxes?
2. If a seasonal receptionist falls for a ClickFix tomorrow, what does the attacker find?
3. Can we revoke a file already sent to a supplier or an agency?
4. Can we show a corporate client who accessed its employees' data?
5. Does the solution work with existing email, SSO and PMS, or does it ask us to replace them?

What is a hotel's real perimeter?

A hotel cannot stop receiving passports and credit cards. It is part of the service. It can stop keeping them in the clear. The security measure that holds is a single one: making sure that what gets taken is worth nothing. Blocking every phishing attempt is a target no property with seasonal staff can promise.

Groups that arrive at the next corporate renewal with an exportable audit trail and a precise answer about where guest data lives will negotiate from a different position than those presenting an updated privacy notice.

Want to see how this works on one of your own workflows? Book a demo of EmailGrant and FileGrant: we start from a group booking or a corporate contract and walk the data from arrival to deletion. Get in touch.

Frequently asked questions

Can a hotel receive credit card data by email?

Only if the card number is protected with strong cryptography, as PCI DSS v4 requirement 4.2.2 requires. A clear-text PDF attachment does not meet the standard, even when the connection between mail servers uses TLS: TLS protects the transport, not the message sitting in the mailbox.

How long can a hotel keep a copy of a guest's passport?

Only as long as it takes to register the data on Alloggiati Web and obtain the receipt. The copy must then be deleted, including copies that arrived by email. The receipt itself is kept for five years.

Are hotels in scope for NIS2?

As a rule not directly, because hospitality is not listed in the annexes of Legislative Decree 138/2024. Hotels are drawn in as suppliers to in-scope entities, which have to assess the risk of their own supply relationships and impose security requirements by contract, with notification duties and audit rights.

What is EmailGrant and how does it protect a hotel's correspondence?

EmailGrant is the secure messaging extension of FileGrant, the file-centric platform from CyberGrant. Staff use it for the messages that carry sensitive guest data: the message and its attachments stay encrypted after delivery, carry an expiry date, can be revoked with one click, and record who opened them and when. External recipients without an account get access through a one-time code.

How does the FileGrant vault work for guest documents?

FileGrant keeps passports, card authorization forms and rooming lists in an encrypted space built on CRYSTALS-Kyber, the NIST post-quantum standard, through the patented Lock&Go technology. Private AI classifies the document automatically and applies the restrictions attached to it; access is governed by role and every opening lands in an exportable audit trail.

How do you share files securely with agencies, tour operators and suppliers?

With named access, role-based permissions, an expiry date and the ability to revoke even after sending, plus an audit trail recording every opening. In FileGrant's encrypted Lock&Go format a file that has already been downloaded stays readable only to whoever still holds permission, so revocation reaches copies that have left the property.

Do EmailGrant and FileGrant replace corporate email or the PMS?

No, they work alongside them. FileGrant supports SSO with Microsoft and Google and runs on-premises on the group's own servers or in cloud within national borders, so it coexists with the mailbox and the PMS already in use without requiring any migration.