Hospitality businesses, from hotels and golf courses to marinas and campgrounds, hire thousands of seasonal workers every year to keep up with holiday travel timing and special events. Hiring and rehiring temporary employees is part of the annual cycle, but that seasonality contributes to the industry’s high employee turnover, which, at about 74%, is nearly five times the average for all industries.1
Those numbers get a lot of attention, and for good reason, but what doesn’t get nearly enough attention is the cybersecurity risk that comes with those stats. While there’s no arguing that seasonal staff is essential to the industry, there’s also no arguing that it can significantly change a hospitality property’s security posture.
As the busy season winds down and managers change their focus from ramping up to slowing down operations, attackers know that outdated user accounts and access permissions are moving lower in the priority list. That means accounts with valid credentials no longer belonging to an active employee are easy targets for cybercriminals. Orphaned accounts like these can remain undetected for months.
According to IBM’s 2025 report, the average data breach in hospitality takes 241 days to identify and contain. By the time it’s discovered, the damage can be significant: the global average breach cost in hospitality for 2025 was $4.03 million, making it one of the few industries where breach costs actually increased.2
The challenge doesn’t end with offboarding. New seasonal employees are needed urgently so they’re onboarded quickly. Many get little or no cybersecurity training, yet are given access to highly-sensitive information in reservation systems and payment platforms. That’s why new employees are high on the target list for cybercriminals. When someone just starts a new job, they may not recognize that a phishing email from “Payroll” or “IT” isn’t real.
Employee manipulation through social engineering becomes even more effective when cybercriminals use AI. It enables them to create highly convincing phishing emails, fake payroll notifications, password reset requests, and even voice calls that closely mimic legitimate communications from managers, HR, or IT.3 These messages are designed to trick employees into revealing sensitive information, sharing login credentials, or clicking malicious links that give attackers unauthorized access to company systems.
Seasonal employees often need to start work right away, moving cybersecurity training to the bottom of the list. Employees need to know things like how to recognize phishing emails, protect guest information, and what to do if something doesn’t seem right. A few minutes of practical guidance before someone logs in for the first time can make a big difference. It gives staff the confidence to stop and ask questions, one of the most effective ways to reduce cybersecurity risk during busy times.
Seasonal staffing changes constantly as new employees arrive and schedules change. All unusual account activity or unauthorized access can easily go unnoticed as a result. Since it’s impossible for anyone to manually monitor the IT environment every second, continuous monitoring solutions can automatically spot issues early on, from suspicious logins and unexpected devices to unusual account activity. Hospitality teams can get the visibly they need to respond before a small issue grows into a costly breach.
Seasonal staffing doesn’t have to mean cybersecurity risk.
At ESP, a NexusTek company, we provide managed IT and cybersecurity services focused on today’s hospitality industry realities, from identity and access management to security awareness training and continuous monitoring. Whether you operate a hotel, golf course, marina, or campground, we help protect your systems, your guest data, and your business—every season.
Our hospitality specialists can help you design and build a security program that works best for your staffing cycle.
https://www.nexustek.com/contact-us
Sources:
1. Hybrid Payroll, Employee Turnover in Hospitality Industry: Why It Happens & How to Fix It, Accessed July 2026
2. IBM, Cost of a Data Breach Report 2025, July 2025
3. EHL Insights, Key Hospitality Technology Trends to Watch in 2025, Updated April 2026