Hacked in Vegas: How Airport Wi-Fi Nearly Compromised a CEO’s Business
One free Wi-Fi login at an airport, and by the next morning a busy CEO’s inbox had over 10,000 spam emails — and someone was trying to book a flight on her card.
Background
Sophie Shrubsole wears two hats: she’s CEO of Westminster Business Council, a community of business owners and entrepreneurs, and she also runs a bespoke travel company specialising in battlefield tours and historical journeys. Both jobs live on her phone.
When she landed in Las Vegas for an industry conference, she did what most travellers do — connected to the free Wi-Fi at the airport so she could order an Uber to her hotel. She had no eSIM at the time, so the airport network was the obvious option. As far as she was aware, everything worked normally. She got to her hotel and went to bed.
The Risk
The next morning, Sophie woke up to more than 10,000 spam emails in her inbox. She spent around three hours going through them, deleting and reporting spam and trying to clean things up. In that same window, someone attempted to use her credit card details — taken from her phone — to buy a flight. American Express caught and stopped the transaction before it went through, but the account had clearly been compromised the moment she connected to that unprotected public network.
Sophie had known Francis for around a year and had heard him talk many times about mobile phone security. By her own admission, she’d been a little lax about acting on it — a familiar story for busy business leaders whose phones carry both their personal and working lives.
What We Did
After the Las Vegas breach, Sophie spoke to Francis, and the first fix was straightforward: installing Lookout for Work, an enterprise-level mobile security app, on her phone. It began scanning continuously in the background — checking every website and link her phone talks to, and watching for phishing and data-theft attempts.
Beyond installing mobile protection, Sophie and Francis talked through a wider fix for public and shared Wi-Fi: setting up separate networks, the way hotels and golf courses already do — one network for the business, one for guests — because an infection on one network cannot simply jump to another. Francis’s own recommendation, which he shared with Sophie, is to run multiple networks at home too: one for family, one for work, one for guests, and one for IoT devices like smart speakers, so an infected device can’t spread to everything else on the same connection.
The Result
In the few weeks since installing Lookout for Work, Sophie says it has already blocked three attempts to phish for data and steal card details from shopping websites — with one of those attempts arriving at 3am, a time she’d have had no chance of noticing or dealing with herself.
On a later occasion, a follow-up email from someone she’d met at a networking event was also blocked by the app as a phishing attempt. When she called the sender to flag it, he had no idea his own systems had been compromised — a reminder that a business’s exposure isn’t only about its own habits, but who it does business with.
A few weeks on, Sophie has real, ongoing visibility into what her phone is doing — including how many websites and links it interacts with in a single day (in the tens of thousands), and how many phishing attempts have been caught before they went anywhere.
Client Quote
“I think this is what a lot of people [get wrong], because they think, oh, it’s an iPhone… it’s Android, it’s not safe. You need to have very good security software on there… without that you’re just walking around in the dark and waiting for attacks.” — Sophie Shrubsole, on why device type alone doesn’t protect you
(Figures on threats blocked are as stated by Sophie in her recorded interview, not independently audited.)
Her advice to others, in her own words: don’t put off protecting what is probably your most valuable asset, get in touch with your IT security provider about the options, and don’t wait until you’ve been hacked, like she was, to take it seriously.
Why This Matters for Regulated B2B Sectors
Business leaders travel constantly — to conferences, client meetings, and industry events — and public Wi-Fi at airports, hotels and stations is exactly where Sophie’s breach began. Law firms, recruitment agencies and finance teams sending partners and directors on the road face the same exposure.
A compromised phone is a compromised business: client data, case files, candidate records and financial details all live on the same device used to check email on an airport network — there’s no meaningful separation between “personal” and “work” risk on a phone.
Firms pursuing ISO 27001 or Cyber Essentials certification need mobile device security in scope, not just laptops and servers — a phone that silently talks to thousands of sites a day is a real, documented attack surface, not a hypothetical one.
As Sophie’s own follow-up call showed, a phishing attempt can originate from a trusted contact’s compromised CRM or email system — meaning your organisation’s exposure isn’t only about your own habits, but who you do business with.
Note: this account is drawn from Sophie Shrubsole’s own recorded, on-camera interview, published on Security Everywhere’s YouTube channel — her name and role (CEO, Westminster Business Council) are used here as they appear publicly in that video.
Not Sure How Exposed Your Team’s Phones Are on the Road?
We offer a free, no-obligation cyber exposure check — covering email security (DMARC), exposed subdomains, and dark web credential exposure — so you know exactly where you stand before it becomes a story like Sophie’s.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
