10 March 2022, Hospitality threat analysis – hotel exposures from the war in Ukraine
10 March, 2022 Security
10 March, 2022 Security
Hotels are the most violent commercial sector in the world. They suffer from many risks: Violent crime, terrorism, arson, strikes/riots/civil commotion, coup d’etat, sabotage, and war. On the nonviolent but still damaging side, cyberattacks plague hotels regularly. Consequently, Moscow’s invasion of Ukraine and associated risks will impact hotels in Ukraine and elsewhere – Eastern, Central, and Western Europe, and beyond. Muir Analytics’ SecureHotel Threat Portal database has scores of war scenarios that illustrate the threat. It has happened before in numerous countries: Ivory Coast, Israel and Palestine, Yemen, Libya, Syria, and Iraq. Here’s a look at the hotel risks in Ukraine and beyond.
On 24 February 2022, says the BBC, Russia invaded Ukraine because, according to President Vladimir Putin, Ukraine was not a real country, Nazis ruled it, and it had always been a part of Russia. But Ukraine’s military forces rallied and blunted the invasion. Then, a large international coalition banded together to condemn and economically penalize Russia for its actions. The coalition is also providing political and military support to Ukraine. In the face of such effective resistance, Putin has threatened to expand the war and use nuclear weapons. By 11 March, Russia had surrounded key Ukrainian cities and was pummeling them. The Russians are firing on civilians as well as military and government targets. In some circumstances, they have battered city blocks with artillery and rockets, making them uninhabitable.
First, based on ongoing Russian military operations that are attacking a wide range of civilian targets, it is probable that hotels in Ukraine sustain light, medium, or heavy damage by military ordinance. This destruction will massively increase if Moscow lays siege to cities like Kyiv. The destruction will come from rockets, missiles, aerial bombs, tank fire, artillery, heavy machine guns, and fires resulting from this weaponry. Total hotel property loss scenarios are possible in cities such as Kyiv, Donetsk, Luhansk, Kharkiv, Horlivka, Zaporizhzhia, Mariupol, Kherson, Mykolaiv, and Odesa, just to name a few.
Kyiv and Odesa have been hit hard, and they are two of Ukraine’s biggest tourist cities. Top-ranked hotels in Kyiv that should be considered at risk include Hilton Kyiv, Premier Palace Hotel Kyiv, Fairmont Grand Hotel Kyiv, and the Opera Hotel. Top-ranked hotels in Odesa that should be considered at risk include Aleksandrovskiy Hotel, Il Decameron Luxury Design Hotel, and Hotel Bristol.
Another prominent Ukrainian tourist city replete with hotels is Lviv in western Ukraine, about 35 miles from Poland. Current reporting says the fighting has yet to reach Lviv, which has turned into a de facto out-processing city for refugees fleeing the war, says NPR. It has also become a rear area planning and coordination locale for Ukrainian resistance. For that reason, Lviv and its hotels should be considered at risk.
Second, hotels in Ukraine that do not suffer heavy damage might face excessive wear and tear from military occupation. Frequently during conflicts, military units take over hotels and use them as command centers and/or barracks. This is a trend that goes back to WW II and beyond. The comings and goings of military personnel with their equipment and soiled uniforms can damage hotels by copious and rough use. Damages typically extend to all common areas, restaurants, ballrooms, and guest rooms.
Third, if Russia takes over Ukraine and declares it part of Russia or a protective state, it is possible Moscow might nationalize many businesses in country, including hotels. If this happens, hoteliers will be facing total investment loss scenarios essentially based on theft, but, more technically, political risk triggers.
Fourth, there is the threat of a nuclear attack or a nuclear accident in Ukraine. A nuclear detonation would have obvious destructive impacts on all buildings, including hotels, near the seat of any blast. Those not immediately impacted would suffer loss of business for as long as radiation fields proliferated – think Chernobyl, a total loss scenario. The nuclear exclusion zone around Chernobyl is 2,600 square kilometers (1,000 square miles.) A small nuclear explosion would have a smaller radiation zone, but the effects would be just as harrowing.
The possibility of nuclear war is real. President Putin has threatened to use nuclear weapons more than once in this conflict, and Reuters says Belarus recently changed its laws to allow nuclear weapons on its soil. Additionally, if the alliance ends up providing weaponry to Ukrainian forces fighting an unconventional war against Russian occupiers, Moscow might label this a NATO attack, which might justify the use of nuclear weapons in the Kremlin’s eyes.
A nuclear accident might occur from fighting over nuclear powerplants or poor handling of them by Russian technicians. The BBC and The Guardian report that Ukraine has five nuclear powerplants, each with multiple reactors (15 reactors in all):
As an aside, though Moscow has not publicly mentioned using chemical or biological weapons, the Independent interviewed anonymous “Western officials” who said if the Russian invasion of Ukraine continues to stall, Russia might use chemical weapons to break the deadlock as was allegedly done by the government in Syria – a Russian ally using Russian tactics, they suggest.
Hotels in Eastern, Central, and Western Europe might suffer from Russia’s war in Ukraine. This is because scores of countries in these sub-regions have banded together to provide military support to Ukraine, including anti-tank and anti-aircraft missiles. Moscow will aim to strike back. Al Jazeera reports these countries include, but are not limited to:
Newsweek said on 7 March that Moscow produced a list of countries deemed unfriendly to Russia, which included all EU countries.
Moscow’s motivation for targeting countries in these sub-regions will increase if they support Ukraine in a drawn-out, unconventional war. These scenarios produce three main risks for hotels (and other businesses) in these areas.
First, there is the risk of Russian cyberattacks. Russia has some of the best cyber hacking capabilities in the world, and organizations linked to Moscow, such as the Conti group, have threatened all countries supporting Ukraine, reports The Verge and Cnet. The Threat Post quoted cyber security company Palo Alto Networks as saying the Conti group is “one of the most ruthless” cyber hacking groups on the planet.
And the Conti group excels at hotel attacks, among others. In November 2021, it hit Nordic Choice Hotels in a massive ransomware operation that impacted 16,000 staff and thousands of guests across 200 properties ranging from Scandinavia, Finland, and the Baltics, says Intelligent Ciso.
Right after the Nordic Choice attack, on 12 December, says The Threat Post, cybercriminals using Conti attack software – estimated to be the Conti group itself – attacked US-based Portland McMenamins, a brewery and hotel/restaurant chain. McMenamins has 12 hotels and 64 restaurants/bars. In January 2022, McMenamins said it had yet to recover from this attack. Its entire computer system was thrown into disarray, including the company’s phones, e-mail network, reservations system, point of sale/credit card processing software, and gift-card software.
Second, the possibility of assassination, sabotage, terror attack, or poisoning happening at hotels in these sub-regions is also possible. Why? As the global Ukraine support alliance builds momentum, government coordinators and arms providers will move into hotels in Europe to help coordinate these efforts in places like Poland, Moldova, Romania, and the like. The same will happen in countries like Germany, which recently abandoned its non-military stance and is providing anti-armor and anti-aircraft weapons to Ukraine. France has likewise taken a key role in the alliance and publicly reminded President Putin that NATO would respond to a nuclear attack in kind.
Again, Moscow will likely strike back. It will probably see Europe’s Ukraine support as an attack on Russia, and it will seek to interdict these activities. It is possible this interdiction might include violence typically seen in assassinations and possibly terror attacks. The Washington Post alleges Moscow has a track record of killing its critics. It cites 10 anti-Kremlin pundits who have mysteriously died since 2003, most of them violently. One of them was Denis Voronenkov, former Russian Member of Parliament, who was killed by an assassin’s bullet on 23 January 2017 as he left the five-star Premier Palace hotel in Kyiv.
There is precedent for poisonings in the current threat environment, too. In 2018, says the BBC, accused Russian operatives infiltrated the UK with a deadly nerve agent, Novichok, in attempts to assassinate Sergei Skripal and his daughter, Yulia. Skripal is a former FSB double agent and enemy of Moscow. The Novichok assassins kept their weapon on them in their hotel before the attack. In November 2006, reports The Mirror, accused Russian assassins smuggled polonium-210, a deadly radioactive material, into the UK to assassinate Alexander Litvinenko. He was also former FSB and KGB who spied for the West. Investigators say the polonium assassins targeted Litvinenko in his London hotel by poisoning his teapot.
The overall supposition is the Kremlin has the demonstrated capabilities necessary to individually eliminate its opponents. Businesses or persons supporting Ukraine should not consider themselves immune from such targeting. This includes hotels and possible Moscow targets staying at hotels.
Third, the same nuclear threats that apply to Ukraine apply to Europe, although the possibility of a detonation in Western Europe is lesser than one in Ukraine – as of 11 March 2022. Friction between Europe and Russia would have to escalate to a much higher degree for a nuclear attack to happen. But Defense One reports that, to US intelligence officials, it is a real risk, and it merits close monitoring.
The US, Canada, Turkey, Greece, Taiwan, Australia, and a host of other countries worldwide are part of the Ukraine support alliance, says Al Jazeera. Some of these countries are providing critical weaponry, such as US-made Javelin missiles that are taking a toll on Russian tanks, armored personnel carriers, and logistics vehicles. Moscow’s list of countries unfriendly to Russia published by Newsweek include the following non-EU countries:
Moscow will aim to punish these countries. This causes two primary risks for hotels in these locales.
First, as previously mentioned, there is a risk of cyberattacks. The purpose of these attacks, if they evolve, will not be to directly impede war material going to Ukraine. Instead, they will serve to undermine and demoralize these governments and civilian populations the same way a terrorist bombing campaign would, but without bloodshed. Actions like this undermine government confidence by causing economic/business mayhem, fear, and making state security agencies look foolish. In short, they have an indirect, erosional effect, which is highly useful in warfare.
Second, there is a risk of hotel violence in these countries under certain circumstances. Those circumstances would entail anti-Russia/pro-Ukraine rallies, conferences, Ukraine-related-VIP activities at hotels, and scenarios not unlike the previously mentioned assassination operations.
On a final note, there have been reported several incidents of low-level, person-to-person acts of violence and vandalism related to the war in Ukraine around the world. For example, in Victoria, Canada, says Global News, police are investigating vandalism at St. Sophia Orthodox Church – a Russian Orthodox church – as a possible hate crime, unless it was staged (a common occurrence in the US.) And in the Greater Toronto Area, police are investigating two criminal incidents involving cars flying Ukrainian flags being vandalized and/or assaulted, says the CBC.
Such disturbances are bound to happen anywhere tensions run high over Ukraine. This is especially true of places where people gather, such as hotels, including Russian themed or affiliated properties.
Muir Analytics’ SecureHotel Threat Portal and military history prove that war directly and indirectly impacts hotels. Damage can range from total loss scenarios from heavy weapons fire to wear and tear from military forces occupying hotels. Based on the threats mentioned here, there seven takeaways regarding risk mitigation suggestions.
First, it is undoubtedly too late for hotels in Ukraine to buy war insurance and like coverages. Moreover, physical security options here are minimal. Accordingly, hotel owners in Ukraine should take stock of the state of their properties pre-invasion, including all assets inside their hotels, and prepare for a wide range of recovery operations if financially feasible.
Second, any hotel in Ukraine covered for war insurance should review their policies, understand their exclusions, monitor the status of their properties, and prepare to file claims replete with photos and video of damage assessments. Drones will be especially helpful in this regard.
Third, hotels without war or like insurance, if they suffer damage, might be out of luck. Having said this, the Ukrainian government did shell out half a billion dollars weeks before the Russian invasion in attempts to keep its aviation sector secure and functional, reports Simple Flying. This was also a government attempt to keep underwriters active in Ukraine’s aviation sector. So, if the war ends in Ukraine’s favor, and hoteliers return to damaged properties, the government, possibly with international help, might activate an insurance or rebuilding program for all business sectors in country. The Ukrainian government will want to rebuild.
Fourth, if Ukraine loses, all bets are off. Hoteliers and other businesses might be looking at total loss scenarios from either destruction or being nationalized by a hostile country.
Fifth, hotels in Europe that might be subject to Ukraine-related violence, especially those close to the conflict zone, and those on Moscow’s “unfriendly list,” should strongly consider increasing physical security and purchasing war, terrorism, or political violence insurance that covers risks mentioned in this briefing. Policy buyers should make sure contracts cover hostile acts from both state and nonstate actors. Cyberattack insurance for hotels in Europe should be deemed a must.
Sixth, hotels in allied support countries outside Europe, especially those on Moscow’s list, should certainly increase cyber defenses and secure cyberattack insurance. Hotel companies and independent brands that express pro-Ukraine sentiments and/or host Ukraine-related events, pundits, or VIPs should increase physical security, too. Random, person-to-person acts of violence like those mentioned in Canada should be anticipated as well. Insurance covering violent risks should be considered, especially if international support makes the war more difficult for Moscow. The McMenamins attack and the nerve agent/radioactive poisoning cases prove that just because one is a small enterprise and/or far from Russia does not mean that one will not be targeted.
Seventh, because of the nuclear threats, hotels for all Eastern, Central, and Western Europe should consider nuclear insurance coverage for direct and indirect impacts. They should also consider chemical and maybe biological warfare insurance.
Muir Analytics runs the world’s largest, most sophisticated hotel violence database – the SecureHotel Threat Portal – with over 1,900 hotel attacks (and growing). We can provide the hospitality sector with intelligence that facilitates full-spectrum risk reduction, which helps hotels protect guests, staff, buildings, brands, and revenues. Contact us for a consultation: 1-833-DATA-444.
“Why has Russia invaded Ukraine and what does Putin want?,” BBC, 12 March 2022.
“Officials fear that Putin may deploy chemical weapons in Ukraine,” Independent, 9 March 2022.
“Concern rising that Putin could use nuclear weapons,” Defense One, 8 March 2022.
“Russia releases lengthy list of ‘unfriendly’ countries,” Newsweek, 7 March 2022.
“How safe are Ukraine’s nuclear power plants amid Russian attacks?,” The Guardian, 4 March 2022.
“The western Ukrainian city of Lviv, a base for war preparations, is on edge,” NPR, 2 March 2022.
“Russian church in Calgary targeted by vandals amid Russia-Ukraine conflict,” Global News, 28 February 2022.
“2 police forces in GTA probe possible hate crimes involving Ukrainian flags, damaged vehicles,” CBC, 28 February 2022.
“A ransomware group paid the price for backing Russia,” The Verge, 28 February 2022.
“Belarus referendum approves proposal to renounce non-nuclear status – agencies,” Reuters, 27 February 2022.
“Conti ransomware group warns retaliation if West launches cyberattack on Russia,” Cnet, 25 February 2022.
“Ukrainian government pays to calm aircraft insurance concerns,” Simple Flying, 13 February 2022.
“Nuclear plant: How close was nuclear plant attack to catastrophe?,” BBC, 5 February 2022.
“McMenamins data breach affects 12 years of employee info,” The Threat Post, 4 January 2022.
“Nordic Choice Hotels hit by Conti ransomware,” Intelligent Ciso, 8 December 2021.
“Russia DID mastermind murder of Alexander Litvinenko in UK, top court rules,” The Mirror, 21 September 2021.
“Russian spy poisoning: Why was Sergei Skripal attacked?,” BBC, 25 October 2018.
“Here are 10 critics of Vladimir Putin who died violently or in suspicious ways,” Washington Post, 23 March 2017.
Copyright©Muir Analytics 2022
