New research from ­SecureTrust’s 2026 Travel Agency Resilience Report reveals that the three greatest threats to travel agency success are recession/reduced customer spending (54%), inflation (60%), and at the top, the risk of ransomware, data breaches, and cyberattacks (68%). The report found the concern over cybersecurity was caused by past precedent — in the last 12 months, 92% of agencies experienced some form of cyber threat. Furthermore, a majority of travel agencies (66%) reported a compromise of sensitive customer data within the last 12 months. 

Cyber incidents targeting travel agencies include: 

• Phishing emails/texts (48%)
• Fraudulent credit card activity (32%)
• Fake website domains or social media accounts (22%)
• Ransomware (22%)
• False booking links (18%)

The report found the issue is deeper than cyberattacks targeting the sector — it’s a structural industry concern. 44% of agency owners report managing cybersecurity alone, while 26% admit the person in charge of cybersecurity (whether themselves or another individual) are not qualified for the task. 

This gap results in a breakdown of fundamental cyber hygiene and protection. 40% report their credentials may have been misused or exposed, with 28% saying employees share passwords across several systems. 36% admit to having outdated cybersecurity technology, and 12% cannot keep up with software updates and patches. 

Yet, only 20% plan to establish an incident response plan within the next 12 months. 

As summer draws closer and agencies anticipate an increase in travel, cybercriminals will likely try to exploit the heightened activity. For an industry that is already vulnerable to cyber threats, this busy season could present even greater concerns. 

The customer data that could be at stake, based on data typically compromised in travel agency breaches, includes: 

• Phone numbers/emails (46%) 
• Full names, birth dates and home addresses (40%) 
• Credit card numbers (32%)
• Passport information (28%)
• Travel itineraries (22%)