66% of Travel Agencies Report Customer Data Compromises in the Past Year, According to New Research from SecureTrust, a VikingCloud Company

Chicago, IL, and Dublin, Ireland – May 20, 2026 – 92% of travel agencies experienced a cyber incident or threat over the past year, and 66% admit sensitive customer data was compromised, according to new research released today by SecureTrust, a VikingCloud company that simplifies PCI compliance for small businesses.

Data exposed spans payment credentials, traveler identity documents, and itinerary records: phone numbers or emails (46%), personal details such as full names, dates of birth, and home addresses (40%), credit card numbers (32%), passport details (28%), and travel itineraries (22%). The mix reflects how much sensitive customer and payment data now moves through small agencies every day.

As a result, 68% now rank cyberattacks, data breaches, and ransomware as the #1 threat to agency success in 2026, ahead of inflation and rising costs (60%) and recession (54%).

“Travel agencies are digitizing faster than they can secure their operations,” said Kevin Pierce, President and Chief Operating Officer at VikingCloud. “Every booking now touches a payment processor, an identity verification service, and an email inbox. That's an expanding attack surface that would challenge even tech-savvy teams. For an independent agency managing security alone, it doesn't take a large-scale breach to do permanent damage.”

The threshold for damage is low: 54% of agencies believe a single leaked passport or visa document exposing their client to lifelong identity theft risk could permanently harm their reputation.

SecureTrust’s research – The Hottest Destination for Cyber Risk: SecureTrust’s 2026 Travel Agency Resilience Report – is based on a quantitative survey of small travel agency owners, operators, and cybersecurity leads across the U.S. and U.K. The findings reveal:

• Third-party payment and booking ecosystems are a critical blind spot: 56% of travel agencies are only somewhat confident in the security of their booking systems, APIs, and payment processors, with most relying on periodic reviews rather than continuous monitoring to vet partners. The vendor systems agencies view as most vulnerable to cyberattack are payment processing gateways (56%), cloud-based booking and global distribution systems (52%), and identity and document verification services (42%).
• Sales velocity is overriding security: 24% of agencies admit they bypass MFA or verification steps during peak periods (holiday rushes, major flight disruptions) to avoid losing a sale. Meanwhile, 38% say their heavy reliance on email makes them vulnerable to AI-powered phishing, and 48% report that employees or ownership have already been targeted by fraudulent texts or emails.
• New payment methods are widening the gap further: 8% of travel agencies have already had biometric or tokenized payment details compromised in a breach in the past 12 months, and 52% say these evolving payment methods will significantly or extremely affect their security risk.
• The financial margin for error is thin: Nearly half of agencies (46%) say a financial loss of less than $100,000 would begin to affect their ability to deliver an acceptable customer experience.

Travel Agency Leaders Can’t Manage Cybersecurity Alone

44% of agency owners manage cybersecurity entirely on their own, and 26% admit they, or the person handling it, don't have sufficient training for the job. Agencies are taking steps to strengthen basics, with 56% improving password security, 52% adopting MFA, 50% exploring AI-driven threat detection, and 36% pushing stronger third-party cybersecurity standards. But for most, there's still no clear or manageable path to reducing cyber risk. The most immediate and practical gap is securing payment environments and cardholder data.

“Most small travel agencies don’t have the time or expertise to track every evolving threat,” Pierce added. “PCI compliance is the most practical starting point because it helps secure their most sensitive customer and payment data across phone, email, online bookings, and other third-party platforms. For small businesses, security has to be achievable—not another distraction.”

To read the full report on travel agencies’ biggest vulnerabilities and practical steps agencies can take to reduce risk, visit here.

About SecureTrust, a VikingCloud Company

SecureTrust, a VikingCloud company, simplifies PCI DSS compliance for small businesses through SecureTrust PCI Manager—a guided self-assessment tool with ASV-certified scanning, and expert support designed for merchants without a dedicated IT security team. For more information on SecureTrust, visit https://www.securetrust.com.

VikingCloud delivers battle-tested cybersecurity and compliance protection that simply works. Our expert-led approach combines proven technology and AI-driven insights with dedicated support—keeping businesses secure, audit-ready, and uninterrupted.

VikingCloud is trusted by over 4 million businesses in 70+ countries to stop threats before they stop business, so they can work on what matters most.  For more information, visit www.vikingcloud.com and follow us at www.linkedin.com/company/vikingcloud/.

Media Contact

Jake Scearbo, Corporate Ink for VikingCloud

vikingcloud@corporateink.com