Ransomware (extortion): Hotel and accommodation, Austria 2017
In one of several attacks, ransomware paralysed the system for the room key cards; guests could no longer get into their rooms, and new cards could not be programmed.
- Incident · 01.2017 · Styria (Turracher Höhe), Austria
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Devices and control systems
As of
What happened
The fully booked hotel paid the ransom demanded in Bitcoin (around 1'500 euros) and made the case public. The operator announced that it would return to traditional keys at the next renovation.
- Affected
- Romantik Seehotel Jägerwirt
- Industry
- Hotel and accommodation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / yes
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Networked locking and till systems need an emergency operation without IT and a network separate from the office.
Sources
- Guests at a luxury hotel were locked out of their rooms until the hotel paid the ransom (opens in a new window) CSO Online · 2017-01
- Ransomware sperrt Hotel-Gäste aus – Betreiber zahlte wohl (opens in a new window) Borns IT- und Windows-Blog · 2017-01