The travel industry is facing a significant cybersecurity challenge as cybercriminals increasingly target travel agencies. A recent breach at Carnival, a global operator, highlighted the vulnerability of even well-resourced companies to social engineering attacks. For smaller, independent travel agencies, the risk is even more pronounced. SecureTrust's 2026 Travel Agency Resilience Report reveals that 66% of these agencies experienced data breaches in the past year, compromising sensitive customer information such as passports and credit card details.

The resurgence of travel advisers, with numbers soaring to 310,000 in 2025, underscores the trust travellers place in human expertise over AI and algorithms. However, this trust is being exploited by cybercriminals. The report indicates that 38% of agencies acknowledge their reliance on email as a vulnerability, making them susceptible to AI-powered phishing attacks. Industry groups are warning of a rise in coordinated fraud targeting these agencies.

The Carnival breach serves as a stark reminder of the potential consequences. For smaller agencies, the worst-case scenario involves travellers arriving at terminals to find their bookings deleted or itineraries altered by hackers. The report suggests that the very trust that makes human advisers indispensable is what cybercriminals are exploiting.

As the travel industry continues to grow, with projected revenues of $134.4 billion this year, the need for robust cybersecurity measures becomes increasingly critical. Agencies are urged to adopt practices such as PCI compliance to safeguard traveller data and mitigate the risk of cyberattacks

This story was selected and published by a human editor, with content adapted from original press material using AI tools. Spot an error? Report it here.