Cyber cover for guest houses.
Optional cyber insurance can help if a cyber attack, scam or data breach stops you trading or exposes your guests' details. Most standard guest house policies exclude or limit cyber losses, so a dedicated policy is usually required.
Last reviewed October 2026
Why a B&B or guest house is a target
Criminals don't only go after big companies. A guest house holds just the kind of details they want, and often has less protection.
Think about what you keep: guests' names, addresses, phone numbers and email addresses, and sometimes card details. You log in to online travel agents (OTAs) such as Booking.com, Expedia and Airbnb, and perhaps your own booking system too. Most owners don't have an IT department keeping watch.
Scammers also know your guests trust messages that seem to come from you. A fake note about a booking, sent at the right moment, can look very convincing.
In the government's Cyber Security Breaches Survey 2025/2026, 42% of micro businesses (1 to 9 employees) reported a cyber breach or attack in the last 12 months. Phishing, using fake emails and websites, was by far the most common kind.
What could happen: real-life examples
These are everyday examples, not real cases. Each one shows what can happen, what it can cost you and how a cyber policy may help. Every policy is different, so check what yours includes.
A fake email from a booking site
- What happens
- An email that looks like it comes from a booking site asks you to log in and check a reservation. The login page is fake, and now criminals have your password. Your guests start getting messages, through the booking site, asking them to “re-confirm” their card details.
- What it can cost you
- Guests who fall for it may lose money, and they'll blame you. You may need IT help to get your account back and lock it down, and you may have to report a data breach. Cancellations and poor reviews can follow.
- How a cyber policy may help
- A cyber policy can include a helpline and IT experts to secure your accounts, legal help with reporting the breach and telling guests, and cover for claims from guests whose details were exposed.
Ransomware the week before Easter
- What happens
- You open an attachment that looks like an invoice. By morning, ransomware has locked the laptop with your bookings and guest records on it, and a message demands payment to get it back. Easter is a week away.
- What it can cost you
- You can't see who's arriving, what they've paid or what they've asked for. You may lose bookings while you piece your records back together, and you'll need an expert to clean and restore your computer.
- How a cyber policy may help
- A cyber policy can include experts to deal with the attack, the cost of restoring your data and systems, and loss of income while you can't trade properly. Any response to a ransom demand is subject to the law and the policy terms.
A lost phone or a stolen laptop
- What happens
- A laptop is taken from your car, or your phone is left on a train. It holds guests' names and addresses, with their booking details, and it isn't encrypted.
- What it can cost you
- That counts as a personal data breach. If it's likely to put guests at risk, the ICO says you must report it as soon as possible, and where feasible within 72 hours. If the risk to guests is high, you must tell them too. That takes time and letters, and sometimes legal advice.
- How a cyber policy may help
- A cyber policy can include legal advice on what to report, the cost of telling guests and the ICO, and help to restore your data. Some also cover claims from guests whose details were exposed.
Bank details that aren't real
- What happens
- An email from a supplier you know says their bank details have changed. It looks genuine, but their email has been hacked or copied, and you pay the next invoice to a criminal. It can work the other way too: a guest gets an email “from you” with new bank details for their deposit.
- What it can cost you
- The money can be hard to get back. You may still owe the supplier, and a guest who paid a criminal may hold you responsible. Ring your bank straight away: the sooner they know, the better the chance of stopping the payment.
- How a cyber policy may help
- Some cyber policies include cyber crime cover for money lost this way, sometimes called social engineering fraud. Cover for money you transfer yourself is often limited or an optional extra, so ask us exactly what a policy includes.
A hacked website
- What happens
- Your website is hacked. Visitors see spam or get sent to a dodgy page, and browsers may start warning people away from your site.
- What it can cost you
- Direct bookings dry up while the site is broken. You'll need an expert to clean it, close the gap the hackers used and get any warnings lifted.
- How a cyber policy may help
- A cyber policy can include IT experts to find and fix the problem, the cost of restoring your website, and loss of income while direct bookings are down. Some also include PR help if your reputation takes a knock.
What a cyber policy can cover
Cyber policies vary a lot. These are the sections a policy can include. Some policies have most of them; others offer some only as extras, or with lower limits. Ask us what a policy includes, and what it leaves out, before you buy.
Incident response and IT experts
A helpline to ring as soon as something goes wrong, and IT forensic experts to find out what happened, stop it and secure your systems.
Restoring data and systems
The cost of recovering or recreating lost data, and getting your computers, booking system and website working again.
Loss of income
Income you lose when a cyber event stops you trading normally. Some policies make you wait a set number of hours before this cover starts.
Telling guests and the ICO, and legal advice
Legal advice on what you need to report, and the cost of telling guests and the Information Commissioner's Office (ICO) about a data breach.
Claims from guests (liability)
Claims against you from guests or others whose personal details were exposed, including the cost of defending them.
Cyber extortion and ransomware
Expert help to respond to ransomware or a demand for money, subject to the law and the policy terms.
Cyber crime and social engineering fraud
Money lost when criminals trick you into paying them, for example with fake bank details. This is often limited, or an optional extra.
Reputation and PR help
Help from public relations experts to talk to guests and limit the damage to your reputation after an incident. Some policies include it.
Many policies also have conditions you need to meet, such as keeping backups or using two-step verification. Check the policy wording.
Simple steps that help
These aren't insurance. They make an attack less likely, and easier to recover from if one happens. Some insurers ask about them before they quote, too.
Turn on two-step verification for your email and every booking site login, so a stolen password isn't enough on its own.
Give everyone their own login rather than one shared password, and remove access when someone leaves.
Back up your bookings and guest records and keep a copy offline or away from your main computer, where ransomware can't reach it. Check now and then that you can restore from it.
Keep software up to date on laptops, phones and tablets, and on your router. Turn on automatic updates where you can.
Check any change of bank details by phone using a number you already know, not one from the email. Tell guests how you take payment, so a fake request stands out.
Take card payments through a PCI-compliant provider such as a card machine or online payment service that meets the card industry's security standard (PCI DSS). Don't keep full card numbers on paper or in emails.
Free help from official sources
- NCSC: Small organisations guide to cyber security
The National Cyber Security Centre's free guide, in plain steps: backing up, protecting your devices and accounts, and spotting scams.
- ICO: Advice for small and medium organisations
The Information Commissioner's Office's guidance and tools for small businesses on looking after personal data.
Questions owners ask
Doesn't my guest house policy already cover cyber?
Usually not much, if at all. Most guest house policies exclude cyber losses or give only a small amount of cover, so check your policy wording.
Look for a “cyber” or “data” exclusion in the wording. Even where a policy covers damage to your computers, it often won't cover the costs of a data breach, ransomware or lost bookings. We can go through yours with you.
Last reviewed October 2026
I only take bookings through Airbnb or Booking.com. Do I still need it?
It's worth thinking about. Booking sites protect their own systems, but your login, your email, your devices and the guest details you keep are still your responsibility.
One common scam is to steal the owner's booking site login, then message guests directly. If your account is taken over, you may lose bookings and face complaints. Whether cover is worth it depends on how you work, so talk it through with us.
Last reviewed October 2026
Does it cover money I've been tricked into sending?
Sometimes. Some cyber policies include social engineering or invoice fraud cover, but it's often limited or an optional extra, so ask us before you rely on it.
Insurers may set conditions, such as checking any change of bank details by phone before you pay. If you've been tricked, ring your bank straight away. The sooner they know, the better the chance of stopping the payment.
Last reviewed October 2026
What about GDPR fines?
Whether a fine can be insured is limited by law, so don't assume a policy will pay one. Some policies cover legal costs if the ICO investigates.
What helps most is looking after guests' data well and knowing what to do if something goes wrong. The ICO has free guidance for small businesses.
ICO: Advice for small and medium organisations
Last reviewed October 2026
Can you add cyber cover to my guest house policy?
Sometimes. Some guest house policies offer cyber as an add-on, but it's more often a separate policy. We'll look at both and explain the difference.
An add-on can be simpler, but the limits are often lower. A separate cyber policy usually gives wider cover. Tell us how you take bookings and payments, and what guest details you keep, and we'll search for cover that fits.
Last reviewed October 2026
Want to talk about cyber cover?
Tell us how you take bookings and payments, and what guest details you keep. We'll explain the options, from an add-on to your guest house policy to a separate cyber policy, with no hard sell.