| Property-management guest records | A property-management breach exposes the guest booking record and forces containment on the system that sells the room. | 0-3 months | Wave 1 (direct) | RMS status page, ACSC notified 30 October 2026 |
| Guest phishing after a booking breach | Guests named in the booking file are asked to treat reconfirmation messages as untrusted, which slows the arrival the hotel already holds. | 0-3 months | Wave 1 (indirect) | RMS phishing guidance to guests |
| Rooms in establishments with 10 or more rooms | The counted room stock cannot be sold at the recent occupancy rate while the booking record is contained. | 0-3 months | Wave 1 (indirect) | TRA benchmark 340,662 rooms and 72.9 percent occupancy |
| Holiday-purpose visitors from China | The holiday-purpose Chinese guest, the lodging and attraction customer on the profile, stops when China travel stops. | 0-3 months | Wave 2 (indirect) | TRA China profile holiday 403,110 and 41 percent |
| Paid experiences and attractions | Eat-out, shopping, beach, and sightseeing demand from Chinese visitors falls with the holiday guest. | 1-6 months | Wave 2 (indirect) | TRA China profile activity rates |
| Medium-business booking vendors | Medium tourism businesses that sell through a shared booking vendor lose new reservations when that vendor is the direct target. | 1-6 months | Wave 2 (direct) | TRA size graph 5 percent medium; RMS vendor incident |
| China share of international spend | The largest international-spend origin stops contributing, and the dollar mix is not a hotel-only receivable. | 0-3 months | Wave 2 (indirect) | IVS China 29 percent of international spend |
| Education-related Chinese trip expenditure | Education-related Chinese expenditure is a demand constraint on length of stay and on the spend total, and it is not hotel or attraction fee income. | 1-6 months | Wave 3 (indirect) | Tourism Australia 8.1 billion dollars and 66 percent |
| Small tourism businesses | The small-business majority of the tourism file has a lower survival rate and an all-sector cyber-cost print that is not a hospitality-only loss. | 1-6 months | Wave 3 (direct) | TRA 95 percent under 20 employees; ACSC small-business cost |
| Taiwan-named visitor arrivals | Taiwan is a named monthly arrival row, separate from China, and it is a small share of the July visitor total. | 12+ months | Wave 3 (indirect) | ABS July 2026 Taiwan 23,910; China footnote excludes Taiwan |