Expert cautions against AI-powered cyber attacks

A technical product manager specialising in digital identity and access management, Ololade Mafimidiwo, said the increasing reliance on digital platforms in the travel and hospitality industry makes sensitive personal data vulnerable to AI-powered attacks.

She warned that the convenience of booking flights, reserving hotel rooms, or making online purchases with just a few clicks is now under threat as cybercriminals leverage artificial intelligence to manipulate and exploit unsuspecting consumers.

“For those of us in the travel and hospitality industry—where sensitive personal data, such as passport numbers, payment information, and itinerary details, flow freely through interconnected systems—this AI-driven threat is not just theoretical; it is a pressing reality,” she said in a statement on Monday.

Mafimidiwo described how AI has revolutionised cybercrime, enabling hackers to automate attacks and personalise phishing scams on an unprecedented scale.

“Large language models, such as those powering AI chatbots, are now being exploited to create phishing emails that are grammatically perfect, contextually relevant, and nearly indistinguishable from legitimate communications,” she said.

According to her, AI is also being used to scrape vast amounts of personal data from social media, booking platforms, and e-Commerce sites. This data is then analysed to craft highly targeted attacks, often referred to as “spear phishing,” where scammers know not just a victim’s name but also their recent trips, purchases, and preferences.

“The result is a level of social engineering sophistication that few individuals are prepared to defend against,” she added.

The travel and hospitality industry, Mafimidiwo noted, is particularly vulnerable due to its dependence on third-party integrations.

Airlines, hotels, online travel agencies, and payment processors all share data via interconnected Application Programming Interfaces, creating multiple entry points for attackers.

“I have seen instances where AI-powered attacks exploit these APIs, using machine learning to identify and target weak points in the data flow. Hackers can automate the extraction of sensitive information, bypass rate-limiting protections, and even launch distributed denial-of-service attacks designed to disrupt operations until a ransom is paid,” she explained.

She also recommended monitoring bookings through official airline and hotel apps instead of relying solely on email confirmations, which can be spoofed.

Mafimidiwo added that companies should invest in AI-powered threat detection systems to monitor for suspicious activity in real-time, conduct regular security assessments, and educate customers about safe online practices.

“A well-informed customer base is less likely to fall victim to scams, reducing the overall success rate of cyberattacks and reinforcing trust in digital travel platforms,” she said.