Ransomware at a hotel: the first 24 hours, step by step

Ransomware is malicious software that locks a hotel's systems or files and demands payment to release them. In the first 24 hours: isolate affected machines without wiping them, call your IT provider, insurer and management, move the front desk to paper, protect the backups, preserve evidence, and take the police and KVKK reporting questions to counsel.

It is 23:40 on a Friday, the lobby is full and the next arrival is at 00:15. The front desk screen shows a text file with a countdown instead of the room list. What happens in the next hour decides how long the outage lasts, whether the insurance claim survives and whether guest data is handled lawfully. This article is the bad-night playbook: the order to act in, the calls to make, the paper fallback for the desk, and where the reporting obligations sit. A ransomware response plan is written before the incident, but this is how it runs.

What does ransomware look like at a hotel, and what do you do in the first minutes?#

Ransomware is software that encrypts a hotel's files or systems and demands payment for the key. The first minutes are about recognising it and stopping the spread without destroying the evidence.

The usual signs arrive together, not one at a time. Files are renamed with an unfamiliar extension. A ransom note appears as desktop wallpaper or a text file on the desktop. The property management system (PMS, the system that runs reservations, the desk and billing) refuses every user at once. Shared folders become unreadable, printers produce pages nobody sent, and backup drives are no longer reachable.

Separate this from an outage. A dead internet line or one slow screen is a different problem; ransomware normally hits several systems in the same hour and leaves a message behind. If two machines show the same note within minutes, treat it as ransomware until told otherwise.

Do not power off blindly. Pulling the plug can destroy what is in memory and can leave a database half-encrypted. Unplug the network cable and disable Wi-Fi instead, and leave the machine running. Do not delete the ransom note, do not run a clean-up tool across the network, and do not let anyone reinstall the affected machines yet.

Do not write to the address in the note and do not send money before the insurer and counsel are in the room. Whether to pay at all is a decision for the owner with the insurer, the IT provider and counsel; this article does not advise either way.

Start a timeline on paper: the time you first saw it, which machine, which screen, what you touched. Every later conversation, with the insurer, the police or a lawyer, depends on that page. And assume the attacker still has access: treat every account and every shared password as compromised until the IT provider says otherwise.

The first hour: who do you call, and in what order?#

Call the IT provider first, then the insurer, then management, and put one named person in charge of the response. The order matters because the insurer's instructions can change what you are allowed to touch.

The IT provider isolates the affected machines, confirms the scope and starts the evidence work. If you have no provider, this is the hour you learn you need one; a named contact and a contracted response time belong in the plan, not in the incident.

The cyber insurer comes second, not last. Many policies set their own notification conditions and can supply forensic help through their panel. Read that clause before the incident, not during it; late notification can weaken a claim. For what a cyber policy covers and what insurers will ask, see our separate guide to cyber insurance for hotels.

Management means three roles, not one person: an incident lead with authority to stop a system and spend money, a communications lead, and an operations lead who keeps the desk running. The general manager cannot hold all three at 23:40 on a Friday.

Counsel joins for two questions only: whether personal data was breached, and what may be said to the attacker and to the public. Keep a call log with time, name and decision; it is the spine of the later report to the insurer and to any authority. Decide in the first hour who is allowed to speak publicly, and tell everyone else to route requests to that person.

How does the hotel keep running while the systems are down?#

The front desk moves to paper: a printed arrivals list, a manual key process and a cash float, all prepared before the incident rather than during it. The same paper fallback works for a plain internet outage, and our front desk checklist for when the internet goes down covers the calmer version of this problem.

The offline arrivals list is the single most useful document. Print the next three days of arrivals, departures and in-house guests at the end of every shift, and keep the copy somewhere that is not on the hotel network. A locked drawer at the desk, not a folder on the file server.

Check-in on paper uses a numbered form: name, identity or passport number, room, rate, nights, payment method and signature. Identity notification (KBS, the misafir kimlik bildirimi that every lodging facility in Türkiye must send) cannot go out from a check-in flow that is down. Capture what is needed on paper and confirm the timing of the catch-up notification with counsel.

Key cards are the next failure. If the lock system depends on the network, you need a mechanical or offline fallback for the encoder. A staff escort to the room is the last resort, not the plan. Card terminals are usually separate from the PMS but often share the same network, so decide in advance how you take payment and how you record the charge so the guest bill can be rebuilt later.

Restaurant and bar run on a paper charge sheet per table, signed by the guest, transferred to the bill once the system is back. Housekeeping keeps a paper room-status board updated by radio or phone. And tell arriving guests at the door, before they reach the desk, so the desk is not explaining the same thing forty times in one evening.

Why must you protect the backups before restoring anything?#

Because attackers often reach the backups first, and a restore from a compromised copy puts the problem back. Check that the copies are isolated, complete and recent before anything is written over the live system.

Disconnect the backup targets from the network: the backup server, the attached drives, the appliance. Then ask the uncomfortable question: did the backup software use the same administrator credentials the attacker already holds? If yes, treat those backups as suspect until proven otherwise.

Look for a copy that a logged-in administrator could not have deleted: an offline drive, a tape, or a copy held outside the hotel's own accounts. Verify the newest clean restore point: how old it is, what it contains, and whether it has ever been test-restored. An untested backup is a hope, not a plan. Our guide to hotel backups covers what to copy, where to keep it and how to test it.

Restore in a fixed order: identity and access first, then the PMS database, then the integrations that carry availability, rates, invoices and identity notifications, then reporting. Restore into an isolated environment first and inspect the result, never straight over the live system.

Keep the encrypted originals. They are evidence for the insurer and the police, and occasionally a decryptor appears later that can recover files without payment.

Where do you report a cyber incident in Türkiye, and who decides what to file?#

There are two separate tracks: a criminal complaint to the police cybercrime units, and, if personal data was obtained unlawfully, a notification to the Personal Data Protection Board. Counsel decides both, and the police track needs a personal application.

For a company whose server was accessed without permission and its database encrypted, the Cybercrime Department of Türkiye's General Directorate of Security gives concrete steps. The company's IT staff should export all event logs for the date and time range of the attack onto CD or DVD. The company then writes and signs a petition describing the crime and takes it by hand, not as a scanned email, to one of three places: the police station responsible for where the crime was committed, the Chief Public Prosecutor's Office for that place, or a Cybercrime Branch Directorate. The Department states that this crime requires a personal application before legal proceedings can start (EGM, Siber Suçlarla Mücadele Daire Başkanlığı, FAQ question 13, 4 November 2026 (opens in a new tab)).

The National Cyber Incident Response Centre no longer runs its services at usom.gov.tr. Its reports, vulnerability applications, malicious link lists and security notices continue at siberguvenlik.gov.tr, run by the Presidency of Cyber Security, established under Presidential Decree No. 177 and Cyber Security Law No. 7545 of 12 March 2025. Reports go through the form at siberguvenlik.gov.tr/ihbar or by email. Article 7(1)(b) of Law No. 7545 (Resmî Gazete 19 March 2025, No. 32846) requires those within the law's scope that provide services or process data using information systems to report vulnerabilities or incidents in their service area to the Presidency without delay. Whether a given hotel falls inside that scope is a legal question for counsel.

On personal data: under Article 12(5) of Law No. 6698, if processed data is obtained by others unlawfully, the controller notifies the people concerned and the Personal Data Protection Board as soon as possible. Board decision 2019/10 of 24 January 2019 reads that as 72 hours from learning of the breach, through the form at ihlalbildirim.kvkk.gov.tr. The people concerned are notified directly where their contact address can be reached, otherwise by suitable means such as the hotel's own website, and the controller records the breach and the measures taken (KVKK, announcement on Board decision 2019/10 (opens in a new tab)).

Export the logs before anyone wipes a machine. The export is the one artefact that cannot be recreated later. Administrative fine amounts change and are re-valued; do not budget from a figure you read online, ask your adviser.

What should you tell guests, staff and travel agencies?#

Tell each group what affects them, in plain words, from one voice, and only what you actually know. Guests care about their room, their bill and their data, in that order.

Guests in house need to know what still works, what to do at the desk, and whether their payment card data is affected. Say the last part only if the forensic work supports it. Guests whose personal data was obtained unlawfully are data subjects with a legal notification: directly where their contact address can be reached, otherwise by suitable means such as the hotel's website. The wording goes through counsel.

Staff need what to do, who to ask, and an explicit instruction not to discuss the incident on social media or with journalists. Add that nobody is in trouble for having opened the wrong file, or the next incident will be reported later than this one. Travel agencies and corporate clients get a short factual note on whether bookings, confirmations and invoices are flowing, plus a named contact who answers.

Do not speculate in public about the cause, the attacker or the timeline. Every guess becomes a correction later. Keep a written log of what was said to whom and when; it is part of the record the Board and the insurer may ask for.

Before you restore: how did they get in, and what changes afterwards?#

The restore ends the outage; the review ends the risk, and it starts with the entry point rather than with new software.

Check the usual entry points in order: a phishing email opened at the desk, one shared administrator password used by several people, a remote-access tool left open for a supplier, an unpatched server, a USB stick brought in from outside. Use the evidence you kept: the exported logs, the ransom note, the affected machines still offline, and the timeline written at minute zero.

The changes that usually follow are unglamorous. One account per person. Two-step sign-in on email and remote access. No shared administrator account. Guest Wi-Fi separated from the systems the hotel runs on. Backups tested by an actual restore. A printed call list at the desk.

Run a tabletop exercise once a year: one hour, one scenario, the people who would actually be on shift at 23:40 on a Friday. Our hotel cybersecurity checklist for owners and general managers collects the preparation work in one place. Write down what you will do differently, with a name and a date against each item, or the review becomes a document nobody opens again.

What to do next#

The next step is small and can be done today: print the call list and the next three days of arrivals, put both in a sealed envelope at the front desk, and book one hour with your IT provider, your insurer and counsel to walk through this order before you ever need it. The sequence in this article is the whole idea: isolate before you clean, protect the backups before you restore, preserve evidence before you report, and let counsel decide the filing while the desk keeps checking guests in on paper.