Ransomware on PMS, POS and front-desk PCs
Ransomware locks your files and systems, then demands payment. For a hotel, that means check-in, tills and the room list can stop within minutes.
Ransomware-like activity stopped
- Device
- FO-PC-02 (front desk)
- Activity
- Hundreds of files renamed in one minuteNeeds checking
- Program
- Unknown, from the Downloads folderNeeds checking
- Action
- Device isolated from the network
Illustration. Names, domains and data shown here are fictitious.
Files locked, then held to ransom
Ransomware is malicious software that encrypts files so they can't be opened. The attackers then demand a ransom for the key, and often threaten to publish data they've already stolen.
The way in is usually simple: an email attachment, a weak remote-access password, or a PC that hasn't been updated in a long time. Attackers often wait several days inside the network before locking everything at once.
What it means for your business
Operations stop
The PMS, POS and other systems that depend on your PCs can go down with them.
Guest data at risk
Reservation data, passports and guest contacts can be stolen before files are locked.
Slow, costly recovery
Rebuilding systems and restoring data takes time, even if you have backups.
Warning signs to look out for
Share this list with your front office, reservations and finance staff. When in doubt, ask first.
- Files suddenly renamed or impossible to open.
- A PC becomes very slow for no clear reason.
- Antivirus turns itself off or won't start.
- A new admin account or unknown remote-access program appears.
- Remote sign-ins outside working hours or from unusual locations.
- A text file with payment instructions appears.
How SiberWisata helps
Ransomware is best stopped before it can lock anything.
Managed Detection & Response (MDR)
MDR monitors PCs, servers, PMS and POS for early signs of ransomware: odd programs, mass encryption and attackers moving through the network. Our analysts confirm the threat, isolate devices as agreed, then contact your named person.
See this service →Security Assessment
Security Assessment tests your network, remote access and systems the way a real attacker would, so the gaps ransomware usually uses can be closed first.
See this service →Monitoring is continuous. Analyst hours and response times are agreed per plan and written into the contract.
Device isolated: FO-PC-02
An unknown program started encrypting files. The device was cut off from the network as agreed. An analyst is investigating.
Illustration. Names, domains and data shown here are fictitious.
How it works
Find gaps first
An assessment finds exposed remote access, weak passwords and unpatched systems.
Keep watching
Key devices are monitored, and suspicious activity is checked by an analyst.
Limit the damage
If there's an attack, affected devices are isolated so it doesn't spread to other PMS and POS machines.
Related threats
All threats →Staff phishing
Fake emails, messages and QR codes aimed at front office, reservations and finance.
Read more →Email account takeover
Work email taken over, including session theft that gets around two-step verification.
Read more →Hijacked OTA accounts
Your partner account on a booking platform is taken over and used to ask guests for payment.
Read more →
Not sure your organisation is safe?
Tell us about your organisation. We look at your situation from the outside and explain what we find in plain language, without obligation.