Article
What the MGM Resorts breach taught businesses about phone calls
A review of the 2023 MGM Resorts attack, where a simple phone call to the help desk led to days of total operational shutdown.
- PROTECT
- EMPOWER
6 min ·
INDUSTRY / HOSPITALITY
The quote went out. The booking went somewhere else.
Hotels, event venues, and hospitality businesses compete on speed and trust: how fast you answer a quote request, and whether a guest believes the message asking for their card details is really from you. Cyber6 helps you close more group and event inquiries, protect guest and card data, and keep your front desk from getting fooled by fake booking-platform messages.
AUTOMATEPROTECTEMPOWER
5 min read
a front desk manager checking a group event inquiry next to a suspicious booking-platform email
Example
Inbox
From: reservations@booking-partner-verify.com
Guest payment failed, please update card details
This is not the real booking platform domain. Do not enter card details.
A guest payment has failed. Please verify the card on file by following the secure link below.
The sender address reservations@booking-partner-verify.com looks like a real supplier but is spelled differently: booking-partner-verify.com.
WE GET IT
We know what your week looks like
- 01
A group inquiry sits in an inbox
A wedding block or corporate event request comes in on a Friday afternoon and doesn't get a quote until Monday, by which point the planner has three other quotes in hand.
- 02
Every booking comes through someone else's platform
Most reservations arrive through third-party sites that take a cut and own the guest relationship, while your own site gets a fraction of the traffic.
- 03
A fake booking-platform message reaches the front desk
An email or message that looks like it's from a major booking site asks staff to "verify" a guest's card details on a lookalike link.
- 04
Seasonal staff turn over fast
Front desk and event staff hired for a busy season leave before the next one, taking their training and judgment with them.
- 05
Guest Wi-Fi and back-office systems share a network
The Wi-Fi offered to guests in the lobby and the systems running reservations and payments were never properly separated.
- 06
Repeat guests never hear from you again
A guest who stayed twice and loved it gets no follow-up before their next trip, so they book through a search engine instead of coming back directly.
- 07
Card data spread across systems
Guest card details pass through a property management system, a point-of-sale system, and sometimes a spreadsheet for event deposits, with different levels of protection on each.
THE IMPACT
What it's costing you
Group business that books elsewhere
A wedding, conference, or corporate block is high value and time-sensitive. A slow quote is usually a lost one, not a delayed one.
Revenue paid away in platform commissions
Every booking that goes through a third-party site instead of coming back to you directly costs a commission you didn't have to pay.
A guest who loses trust in your brand
If a guest falls for a fake message impersonating your property, the damage to trust and reputation lands on you, not the scammer.
A card data breach during peak season
A payment data incident during your busiest months compounds lost bookings with fines, notification costs, and reviews that mention it for years.
A property that goes dark during a stay
A reservation or point-of-sale outage during check-in or a full house is a guest experience problem that shows up in reviews the same day.
COMPLIANCE
Rules you have to follow
PCI DSS
- What it is
- The payment card industry's security standard for anyone accepting card payments.
- Who it applies to
- Any property or venue taking card payments for rooms, events, or point-of-sale purchases.
- What it expects of you
- Secure payment terminals and systems, a protected network, and limits on who can access stored card data.
- How Cyber6 helps
- We secure your property management and point-of-sale systems, separate them from guest Wi-Fi, and document your compliance posture.
CCPA and GDPR (for international guests)
- What it is
- State and international privacy laws that apply based on where your guests live, not just where your property sits.
- Who it applies to
- Properties serving California residents or guests from the EU or UK, including those booking through international travel sites.
- What it expects of you
- Clear handling of guest personal data, and a way to respond to data access or deletion requests.
- How Cyber6 helps
- We help you map what guest data you hold, where it lives, and how to respond if a guest asks about it.
This is general information, not legal advice.
THE FIX
How Cyber6 helps
AUTOMATE
Fill the gaps automatically
- Get found
The right customers find you on Google, AI search, and social, in your own voice.
- Get customers
Every call, text, form, and quote turns into booked work.
Quote-to-book
Automatic, timely follow-up on every open quote, with reminders to sales staff on the ones that need a personal touch.
Inquiry response
Every inquiry gets an immediate acknowledgment and next step, any time it arrives.
- Serve customers
Customers hear from you at the right time, without your team chasing them.
Repeat guest outreach
Timed outreach to past guests ahead of anniversaries, return seasons, or past event dates, pointing them back to book directly.
- Get paid
Money you've already earned comes in sooner, without awkward phone calls.
- Run the business
Less retyping and waiting, more time for the work that matters.
PROTECT
Protect what you're trusted with
- 01
Property management and point-of-sale systems secured
We put and access controls on the systems that hold reservations, guest records, and payment data.
What this means for you: A stolen password isn't enough for someone to reach guest or card data.
- 02
Guest network kept fully separate
Guest Wi-Fi is isolated from the systems running reservations, payments, and back-office operations, even during high occupancy.
What this means for you: A compromised guest device on the lobby Wi-Fi can't reach anything that matters to the business.
- 03
Email security that flags impersonation attempts
Messages spoofing booking platforms or guests are filtered and flagged before they reach a front desk inbox.
What this means for you: The fake "update your card" email gets caught before someone acts on it.
- 04
Card data handling reviewed against PCI DSS
We review every place card data touches your operation, from booking to point-of-sale to event deposits, and close the gaps.
What this means for you: You go into your next PCI assessment with documentation instead of guesswork.
EMPOWER
Train the people doing the work
Front desk, reservations, and event staff
Front desk social engineering training
How fake booking-platform messages and phone calls try to get card details or system access, and the verification habit that stops it.
Seasonal and part-time staff
Seasonal staff onboarding
A short, repeatable training module so security awareness doesn't reset every time staff turn over.
A DAY WITH CYBER6
A day at your property with Cyber6
9:00 AMAUTOMATE
A wedding block inquiry from Saturday gets an automatic acknowledgment and is already flagged for a sales call by 9:15.
11:30 AMPROTECT
An email impersonating a major booking platform, asking to verify guest card details, is caught and quarantined before it reaches the front desk.
2:00 PMAUTOMATE
A guest from last year's anniversary stay gets a personal note ahead of the date, with a link to book directly.
6:00 PMEMPOWER
A newly hired seasonal front desk agent completes a short training module and reports a suspicious call before it goes anywhere.
YOUR TOOLS
Systems we commonly see
- Cloudbeds
- Oracle OPERA
- Mews
- Toast
We work alongside the systems you already use. We'll confirm what connects during your assessment.
QUESTIONS
Questions from hospitality
We build direct outreach to past guests and faster response to direct inquiries, so more bookings come to you without a platform in between.
We work alongside the major systems and confirm exactly what connects during the assessment.
It's built to be short and repeatable, so new seasonal hires can complete it quickly and it doesn't rely on any one person remembering it.
Yes. It's a basic PCI DSS expectation, and it closes a gap before anyone tests it against you.
We help you handle their data in line with GDPR where it applies, alongside U.S. requirements like CCPA.
Nothing. It's a free review of your booking response times and security, with a plain-English summary of what to fix first.
Yes. We schedule changes around your calendar and avoid making changes during peak occupancy unless something is urgent.
RESOURCES
Learn more
ArticlePCI compliance for small business: what card-taking businesses must do
Every business that accepts credit cards must follow the PCI Data Security Standard. Learn the steps to secure your payments and stay compliant.
- PROTECT
6 min ·
ArticleQR code phishing (quishing): what to watch for
QR code phishing, or quishing, is a growing threat where attackers use malicious QR codes to bypass security filters and steal credentials from mobile users.
- PROTECT
6 min ·
WHO WE'VE WORKED WITH
- A statewide cybersecurity assessment program
- Credit unions
- A water and wastewater utility
- Housing organizations
- Nonprofits and churches
- Small businesses
- A health and wellness startup
Every result is measured against your own starting point.
How we prove it →PART OF ONE PARTNER
One partner for all three.
Protect · IT & Cybersecurity
IT and cybersecurity, managed around the clock.
You're here
Empower · Training for Businesses & Individuals
Training that builds skills for your team and your career.
Explore Empower
WHY CYBER6
Why businesses choose Cyber6.
One partner, not three vendors
The people automating your work also run and protect your IT and train your team, so nothing falls between companies.
Plain language and real people
You talk to people who explain things clearly, answer the phone, and tell you what they'd do in your place.
Measured against your own numbers
We record where you start before anything changes, then report results against that baseline.
Marquis Carroll, Founder & CEO. Marquis has spent years doing hands-on IT and security work through his own business, and runs a mentorship program that has helped people start careers in tech.
Our storyGETTING STARTED
Four steps from first call to results.
Explore
A relaxed 30-minute conversation about how your business runs and what's getting in the way. No cost, no pressure.
You get: honest answers on whether we can help.
Assess
We look at your systems, security, manual work, and training needs, and record your starting numbers.
You get: a plain-English picture of your risks and opportunities.
Set up
A prioritized plan and proposal, then a kickoff that introduces your team and sets up access safely.
You get: a shared timeline and who to call for what.
Enable
We roll out in phases, train your team, and walk you through your first results.
You get: your first plain-English report, measured with PROVE.
Let's look at your bookings together.
A 30-minute call. No cost, no pressure, and honest answers.