Real attacks, explained for business owners
Each article tells one cyberattack that really happened: how they got in, what it cost, and what you can check today so it does not happen to you. Facts only, with the sources at the end.
ID documents stolen from Italian hotels: what happened and what changes at the front desk
· Italy
Between June and July 2025 someone got into the systems of several Italian hotels and took the scans of the documents collected at check-in. In August they were put up for sale. Italy's data protection authority opened an investigation and later clarified something many hotels do not know: those copies should not have been kept.
The fake Booking.com emails that get front desk staff to paste a command
· Hotels worldwide
A negative review, a guest question, an account check: they look like Booking.com messages, but they are not. Microsoft tracked this campaign from December 2024: it gets front desk staff to paste, by themselves, the command that installs a password-stealing program.
TeamSystem customer IBANs stolen: the real risk is the email that changes the bank details
· Italy
From the afternoon of 24 August 2026 someone got into Contabilità in Cloud, the accounting software of Italian company TeamSystem, and took the data customers had stored in it: personal details, contacts and IBANs. The most likely damage now is not the theft itself, but the fake emails that this data makes believable.
Endesa: customer IDs and IBANs left through an internal account
· Spain
In January 2026 Endesa, Spain's large electricity company, and its brand Energía XXI confirmed that someone got into their commercial platform. Not through a hole in the website: through internal accounts, the logins of people who work there. Customers' identity details, contacts, ID numbers and IBANs were exposed.
Brazil: a password sold for $2,700 and hundreds of millions gone from the banks
· Brazil
In late June 2025 criminals used the access of C&M Software, the company that connects several Brazilian banks to the PIX instant payment system, to order fraudulent transfers. They did not find a hole in the software: an IT employee had sold his username and password for about $2,700.
Marks & Spencer: one password reset by deception and 46 days without online orders
· United Kingdom
On 17 April 2025 someone posed as one of the 50,000 people who work with Marks & Spencer and convinced an outside supplier to reset an employee's password. That led to a ransomware attack: online orders stopped for 46 days and a cost the company itself puts at about £300 million.