Digital Bullying as a Cyber-Symbolic Threat: Rethinking Cybersecurity in Tourism and Hospitality

Introduction

The rapid digital transformation of tourism has fundamentally reformed how hospitality and tourism establishments operate, communicate, and compete in the global market (Bekele & Raj, 2024; Buhalis, 2019). Technology-mediated and platform-based interactions, smart tourism infrastructures, algorithmic recommendation systems, and online reputation mechanisms have become central to contemporary tourism systems (Buhalis, 2019; Gretzel et al., 2015; Xiang et al., 2021). Although these progresses have boosted competence and connectivity, they have concurrently exposed tourism establishments to an array of cybersecurity threats that extend well beyond traditional technical vulnerabilities (Akamavi et al., 2022; Ghaderi et al., 2026).

The tourism literature has long theorized and conceptualized cybersecurity mainly in technical and managerial terms, concentrating on data protection, information system integrity, payment security, and privacy risks (Florido-Benítez, 2025; Paraskevas, 2023). More contemporary research has extended this lookout by highlighting destination-level cybersecurity resilience, specifically in smart tourist destinations where compound networks such as high-tech and digital infrastructures, governance mechanisms, and stakeholder interactions shape interconnected dynamic systems (Florido-Benítez, 2024; Ghaderi et al., 2024).

Another strand of research has reoriented the focus to the experiential dimension of cybersecurity, emphasizing how tourist experimental involvement with digital platforms can create perceptions of vulnerability, exposure, and loss of control, especially among marginalized or vulnerable groups such as solo female travelers (Akamavi et al., 2022; Ghaderi et al., 2025). Additionally, research on sharing economy services demonstrates that cybersecurity fears frequently initiate through trust-based digital interactions and reputational mechanisms rather than direct system breaches (Ghaderi et al., 2026; Pigola & de Souza Meirelles, 2026).

Yet these strands have not sufficiently examined how trust-based digital interactions in tourism may become vulnerable to coordinated reputational aggression. By coordination, we refer not to multiple independent negative opinions, but to patterned and mutually reinforcing digital behavior, including irregular review velocity, synchronized posting, repeated textual templates, cross-platform repetition, coordinated reporting, shared hashtags, or reciprocal amplification directed at a specific tourism actor. This argument is grounded in established research on review manipulation and coordinated online behavior, while extending it conceptually to platform-mediated tourism vulnerability (Cinelli et al., 2022; Giglietto et al., 2020; Luca & Zervas, 2016; Mayzlin et al., 2014). Although prior studies have addressed privacy, online reputation, and perceived vulnerability in digital tourism environments (e.g., Ghaderi et al., 2025, 2026; Pigola & de Souza Meirelles, 2026), less attention has been paid to how suspicious rating patterns, organized reputational attacks, and hostile digital discourse generate wider governance- and cybersecurity-relevant vulnerabilities for tourism actors. Moreover, despite moving beyond narrow technical concerns, tourism cybersecurity research still primarily emphasizes data protection, system integrity, privacy, and individual perceptions of online risk (Florido-Benítez, 2024; Paraskevas, 2023; Parsons et al., 2021).

In parallel, established research has examined online reviews, electronic word of mouth, social media, and digital trust as influential factors in travel decision-making (Pigola & de Souza Meirelles, 2026; Sparks & Browning, 2011; Xiang & Gretzel, 2010). The key gap is not the absence of research on reviews or digital trust, but the limited theorization of how platform-enabled reputational aggression exploits digital infrastructures, visibility regimes, and moderation processes to produce organizational and governance vulnerabilities (Gillespie, 2018; Pipyros & Liasidou, 2025; Yallop et al., 2021). This gap is especially evident in relation to digital bullying, understood here as targeted, repeated, or coordinated digitally mediated practices intended to intimidate, delegitimize, silence, or harm specific actors (Ghosh et al., 2025).

In tourism contexts, where institutional value and merit are closely associated with trustworthiness, reliability, appropriate reputation, and symbolic legitimacy (Nunkoo et al., 2012; Wang, 2018), such performances can cause substantial damage even in the absence of any technical failure. However, “digital bullying” has usually been studied within the context of psychology (Li et al., 2022), education, and communication as a form of interpersonal hostility or divergent online behavior (Kowalski et al., 2014). In the tourism context, this concept has not received attention, despite its significance in the contemporary digital era, when technology predominates across different aspects of the tourism system.

This research letter argues that tourism businesses and destinations are increasingly vulnerable to digital hostility and reputational destabilization within platform-mediated tourism systems. Rather than treating digital bullying as a peripheral reputational problem, we conceptualize its coordinated manifestations as a cyber-symbolic threat, which is a form of digitally mediated symbolic violence that targets the symbolic capital of tourism stakeholders (Gillespie, 2018; Patchin & Hinduja, 2012). This framing does not compare reputational harm with conventional technical cybersecurity breaches. Instead, it shows how coordinated symbolic attacks become cybersecurity-relevant when enacted through platform infrastructures, algorithmic amplification, and visibility systems that intensify exposure, weaken organizational control, and destabilize legitimacy (Gillespie, 2018; Tuomi & Ascenção, 2023; Van Dijck et al., 2019). Accordingly, the paper positions some forms of digital bullying not as technical incidents per se, but as platform-enabled vulnerabilities with consequences for reputation, governance, and resilience in tourism contexts.

To develop this argument, the current research draws on Bourdieu’s theory of symbolic power (Bourdieu, 1991). This theory is particularly well-suited to analyzing digital tourism environments, as it foregrounds struggles over legitimacy, recognition, and authority within structured social fields. Building on prior tourism research on cybersecurity resilience, platform-mediated risk, and uneven digital vulnerability (e.g., Cobanoglu & DeMicco, 2007; Ghaderi et al., 2024; 2025; Paraskevas, 2023; Shi et al., 2025), this research reconceptualizes cybersecurity as a symbolic and technical concern and offers a theoretical lens for understanding digital bullying in the tourism context.

Building on this argument, this research does not claim that tourism is uniquely exposed to symbolic or discursive digital harms, nor does it seek to classify all negative online conduct as digital bullying or all reputational damage as cybersecurity. Rather, it argues that tourism displays a distinctive configuration of cyber-symbolic vulnerability because trust, legitimacy, and market value are increasingly mediated through platform visibility, user-generated content, and place-based imaginaries at the point of consumer choice (Nunkoo et al., 2012; Tuomi & Ascenção, 2023; Xiang & Gretzel, 2010). Hotels, restaurants, destinations, and sharing-economy hosts are evaluated not only through service performance but also through ratings, reviews, images, rankings, and circulating narratives that shape symbolic trust and booking behavior (Sparks & Browning, 2011; Tuomi, 2021). Accordingly, the contribution of this research letter is to conceptualize a bounded category of cyber-symbolic threat as targeted, repeated, or coordinated platform-mediated aggression that exceeds ordinary customer dissatisfaction and exploits digital visibility systems to undermine the symbolic capital, trustworthiness, and legitimacy of tourism actors (Bourdieu, 1991; Gillespie, 2018; Nunkoo et al., 2012; Van Dijck et al., 2019).

The focus is therefore not tourism-exclusive behavior, but the tourism-specific consequences of broader platform-mediated harm. Negative e-WOM, fake reviews, review manipulation, and coordinated online aggression also occur across e-commerce and other platform economies. However, their effects are particularly consequential in tourism and hospitality because tourism products are intangible before consumption, highly trust-dependent, reputation-sensitive, seasonally vulnerable, and strongly shaped by reviews, ratings, social media visibility, destination image, and platform ranking systems (Sparks & Browning, 2011; Tuomi & Ascenção, 2023). In this context, attacks on symbolic trust and digital visibility are not merely reputational disturbances; they can influence booking decisions, weaken destination confidence, intensify employee and managerial pressures, and erode organizational legitimacy.

Cybersecurity in Tourism: Beyond Technical Vulnerabilities

Cybersecurity research in tourism has traditionally focused on protecting digital infrastructures, customer data, and transactional systems (Paraskevas, 2023;Parsons et al., 2021). While these concerns remain critical, they provide an incomplete picture of the risks facing tourism business sectors in platform-dominated environments (Tariq, 2024). Research on smart destinations reveals that cybersecurity resilience is formed by interactions among technological systems, institutional arrangements, and stakeholder behavior rather than by technical robustness alone (Ghaderi et al., 2024; Ma, 2021; Rawat & Ghafoor, 2018). Similarly, research on sharing economy platforms shows that cybersecurity threats often emerge from trust-based exchanges, peer-to-peer interactions, and reputational systems that blur the boundaries between technical and social risk (Ghaderi et al., 2026; Islam & Kundu, 2020). These findings suggest that cybersecurity risks in tourism are increasingly socio-technical and symbolic in their operation and effects, even though they should not be collapsed into a single undifferentiated category of threat. Digital environments intensify visibility, accelerate reputational dynamics, and allow collective forms of judgment that can profoundly affect organizational legitimacy (Lock & Jacobs, 2025). As a result, tourism businesses are exposed to risks that function through discourse, meaning-making, and symbolic evaluation rather than through system intrusion alone.

Operationally, such vulnerabilities may emerge through fraudulent review campaigns, coordinated reporting, manipulated ratings, impersonation, bot-assisted amplification, and inconsistent content moderation. These mechanisms do not directly compromise systems in the same way as malware, ransomware, or data theft, but they can distort trust signals, alter platform visibility, trigger resource-intensive crisis responses, and undermine managerial control over digital reputation and consumer perception (Gillespie, 2014; Restaurant Business Online, 2025; Reuters, 2025; Tuomi, 2021). Accordingly, the relevance of these threats lies not in treating them as conventional breaches, but in recognizing that they exploit digital infrastructures to produce organizationally significant harm.

“Digital Bullying” in Platform-Mediated Tourism

Digital bullying in tourism is not used here as a residual label for all negative online conduct. Ordinary negative reviews, emotional complaints, and critical e-WOM are not digital bullying when they reflect genuine consumer dissatisfaction, even if strongly expressed (Sparks & Browning, 2011). Similarly, fake, spam, or manipulated reviews are not automatically considered digital bullying; prior research has already treated these as distinct forms of online review manipulation (Mayzlin et al., 2014). They become relevant to this concept only when they are targeted, repeated, coordinated, or strategically amplified in ways that seek to intimidate, delegitimize, silence, or damage a specific tourism actor, consistent with the intentional, repeated, and harmful character of cyberbullying (Kowalski et al., 2014; Patchin & Hinduja, 2012). Therefore, digital bullying refers to digitally mediated aggression that exceeds ordinary customer evaluation and functions as reputational intimidation or symbolic harm directed at an organization, destination, employee, host, or stakeholder (Al-Turif & Al-Sanad, 2023; Li et al., 2022; Luca & Zervas, 2016).

Within this broader category, review bombing is examined not as a synonym for digital bullying but as one manifestation of coordinated reputational aggression, in which large volumes of fraudulent or strategically mobilized negative reviews are deployed to damage visibility, ratings, trust, and organizational legitimacy (Restaurant Business Online, 2025). However, while online review systems are a central site through which cyber-symbolic harm becomes visible, they do not define the full scope of the phenomenon. Digital bullying in tourism may also operate through hostile comment cascades, influencer-led mobilization, coordinated reporting, impersonation, destination-shaming campaigns, platform visibility attacks, or cross-platform amplification of delegitimizing narratives (Gillespie, 2018; Tuomi & Ascenção, 2023; Van Dijck et al., 2019). Review systems are thus treated as a key empirical illustration rather than as the conceptual boundary of the study.

In such cases, the harm is not reducible to ordinary consumer dissatisfaction; rather, it is amplified through algorithmic infrastructures that privilege emotionally charged, high-engagement content and accelerate reputational cascades (Gillespie, 2014). In tourism contexts, where symbolic trust underpins consumer decision-making, these practices can erode legitimacy, damage employee well-being, and undermine long-term organizational resilience (Tuomi, 2021). Importantly, such harms may occur without any direct breach of technical security, which is precisely why they expose the limits of conventional cybersecurity frameworks while still remaining relevant to cybersecurity debates in platform-mediated environments.

These harms also unfold through stakeholder perception and lived experience. Tourists may interpret suspicious reviews, hostile comment environments, or abrupt rating distortions as signals of unreliability, insecurity, or poor service quality, thereby affecting trust formation and booking decisions (Pigola & de Souza Meirelles, 2026; Tuomi, 2021). Employees may experience such attacks as emotional strain, reputational pressure, and intensified digital labor when required to monitor, explain, or respond to hostile online content (Dar et al., 2026). Managers, in turn, may perceive these incidents not merely as communication problems but as threats to legitimacy, organizational control, and longer-term resilience in highly visible platform environments (Lock & Jacobs, 2025; Tuomi & Ascenção, 2023).

Bourdieu’s Theory of Symbolic Power and Digital Tourism

Bourdieu (1991) theorizes symbolic power as the capacity to impose meanings, legitimize particular visions of reality, and naturalize social hierarchies. Contemporary tourism businesses operate in a digital environment where symbolic capital (e.g., reputation, credibility, and moral standing) is recurrently appraised through platform metrics, user-generated content, and algorithmic visibility (Stark & Pais, 2021; Van Dijck et al., 2019). In this context, “digital bullying” functions as “symbolic violence,” redefining organizational identities and social positions through repeated and amplified narratives (Couldry & Hepp, 2018; Ibrahim, 2023). Influencers, platform algorithms, and organized user groups emerge as powerful actors capable of reshaping destination and organizational meanings, often beyond the control of formal governance structures (Ghaderi & Béal, 2026).

From a Bourdieusian perspective, coordinated forms of digital bullying can be interpreted as cyber-symbolic violence insofar as they target symbolic capital rather than directly compromising technical systems (Bourdieu, 1991). Language, imagery, ratings, and metrics become tools of domination, enabling certain actors to impose negative meanings and delegitimize tourism businesses through reputational and visibility-based mechanisms (Reuters, 2025; Tuomi, 2021). This interpretation resonates with earlier tourism research demonstrating how cybersecurity threats are experienced as symbolic exposure and loss of control, particularly among vulnerable actors in digital tourism spaces (e.g., Ghaderi et al., 2026; Safitra et al., 2023; Zhang, 2022).

An Integrated Cyber-Symbolic Risk Management Framework for Tourism

To make this conceptual argument more analytically explicit, we propose an integrated cyber-symbolic risk management framework for tourism (Figure 1). The framework links four interrelated layers. First, cyber-symbolic harms are triggered by platform-enabled threat vectors, such as fraudulent reviews, coordinated reporting, impersonation, bot-assisted amplification, and hostile comment cascades. Second, these harms operate through platform infrastructures, including ranking systems, moderation rules, review architectures, and visibility algorithms that shape how harmful content circulates, persists, and gains legitimacy (Gillespie, 2018; Tuomi & Ascenção, 2023; Van Dijck et al., 2019). Third, these infrastructures intensify discursive processes through which delegitimizing narratives, trust-signal distortion, and reputational escalation are produced and normalized. Fourth, these discursive dynamics are embedded within power structures, where symbolic power, unequal credibility, and platform-governance asymmetries influence whose narratives become authoritative and whose interests remain vulnerable (Bourdieu, 1991; Harracá et al., 2023). In tourism settings, the interaction of these four layers may generate not only operational effects, such as monitoring burdens and crisis-response costs, but also symbolic and governance effects, including trust erosion, legitimacy loss, reduced managerial control, and heightened dependence on platform decisions.

OPEN IN VIEWER

Figure 1.

Integrated cyber-symbolic risk management framework for tourism.

The framework also clarifies how technical risk management should be connected to discursive and power-sensitive analysis rather than treated as a separate domain. In tourism and hospitality, technical mechanisms such as detection systems, platform reporting procedures, content moderation, and incident escalation protocols do not merely manage information-security events; they also shape how symbolic harms are identified, classified, amplified, or contained. Accordingly, cyber-symbolic risk management should be understood as a cross-functional process in which IT/cybersecurity, communication, legal, operations, and destination governance players jointly respond to harms that are simultaneously infrastructural, discursive, and political. This integration is particularly important in tourism because online visibility, trust formation, and place-image are central to demand, legitimacy, and competitive positioning (Ghaderi et al., 2024; Nunkoo et al., 2012).

Theoretical and Practical Implications

This research letter offers several important theoretical and practical implications by reframing digital bullying not as a conventional technical cybersecurity threat, but as a cybersecurity-relevant and cyber-symbolic concern that has been underestimated when treated merely as a peripheral reputational issue. From a theoretical perspective, it advances tourism cybersecurity scholarship by moving beyond dominant “techno-managerial” approaches and introducing a cyber-symbolic lens grounded in Bourdieu’s (1991) theory of symbolic power. Existing tourism research has generated important insights into technical cybersecurity risks, digital trust, privacy, online vulnerability, and platform-mediated reputation (Ghaderi et al., 2026; Paraskevas, 2023). However, these strands have remained weakly connected to research on coordinated reputational aggression, review manipulation, and algorithmically amplified visibility harms. Our contribution is to bring these conversations into closer dialogue by conceptualizing how digitally mediated symbolic attacks may become cybersecurity-relevant without collapsing them into conventional technical incidents.

The research, thus, contributes to tourism cybersecurity scholarship by conceptualizing cyber-symbolic threat as a bounded category of platform-mediated harm. The contribution is not to redefine cybersecurity so broadly that all reputational harm becomes cyber risk. Rather, it shows how targeted, repeated, or coordinated symbolic aggression becomes cybersecurity-relevant when it exploits platform infrastructures, visibility systems, review architectures, and moderation processes to damage trust, legitimacy, and organizational control in tourism and hospitality. More specifically, our research conceptualizes cybersecurity in tourism as a socially structured field in which vulnerability may be produced through visibility, discourse, reputational manipulation, and symbolic domination, as well as through technical intrusion. This perspective extends prior tourism research on cybersecurity resilience and digital vulnerability by demonstrating how symbolic capital, such as legitimacy, moral credibility, and reputational authority, can be systematically undermined through digitally mediated practices of bullying and harassment.

The application of symbolic power theory also contributes to broader tourism debates on platformization and power asymmetries (Cutolo & Kenney, 2021; Ghaderi & Béal, 2026; Tuomi & Ascenção, 2023). Digital platforms are not neutral intermediaries but structured fields that privilege certain actors, narratives, and forms of capital (Harracá et al., 2023; Marino et al., 2022). Furthermore, framing digital bullying as a form of cyber-symbolic violence, this study offers a theoretical bridge between tourism cybersecurity studies and critical tourism scholarship concerned with inequality, exclusion, and governance in digital spaces (Tuomi & Ascenção, 2023). This novel perspective opens new pathways for research on how algorithmic infrastructures, influencer cultures, and user collectives restructure power relations within tourism systems, challenging existing assumptions about agency and control in digitally mediated tourism environments. For example, platform society theory helps us understand how social media and digital platforms shape behavior, influence norms, and enable both bullying and protective mechanisms through their algorithmic governance (Tuomi & Ascenção, 2023).

Likewise, legitimacy theory allows examination of how businesses attempt to maintain social or institutional legitimacy (Crossley et al., 2021; Peng et al., 2024) in response to cyber threats, harassment, or unethical online behavior. Finally, symbolic power shapes how social hierarchies, status, and cultural capital can be leveraged or challenged in online spaces, illuminating why certain individuals or groups can exert disproportionate influence, including through cyberbullying (Dar et al., 2026; Tahir & Qayyum, 2025). Together, these insights provide a multidimensional lens to explore the social, technological, and power-related structures underpinning digital bullying and cybersecurity, moving beyond purely technical or individual-focused explanations.

This research also has important practical implications. First, reframing “digital bullying” as a cyber-symbolic threat fundamentally restructures how tourism and hospitality businesses understand and respond to online harassment and reputational attacks. In some tourism contexts, particularly highly platform-dependent settings, coordinated reputational attacks may be addressed primarily through fragmented public relations, customer service, or short-term crisis response routines rather than through integrated cybersecurity and governance frameworks (Putranto et al., 2025; Tuomi & Ascenção, 2023). We do not suggest that this fragmented response is universal; rather, where it occurs, it can obscure the wider organizational and platform-governance consequences of coordinated digital aggression. From this perspective, digitally mediated reputational attacks should be understood not only as communication problems but as cyber-symbolic risks requiring cross-functional and inter-organizational response capacity (Tuomi & Ascenção, 2023; Van Dijck et al., 2018). This reframing encourages industry actors to integrate symbolic risk assessment into cybersecurity strategies, develop algorithmic literacy, and coordinate collectively through destination management organizations and industry associations. Accordingly, responsibility shifts from individual firms toward shared institutional responses, including engagement with platforms over moderation practices, visibility controls, and algorithmic amplification. This practical contribution is especially relevant to hotels, restaurants, sharing-economy hosts, and destination stakeholders whose visibility, legitimacy, and market performance are strongly shaped by online reviews, user-generated content, and platform moderation systems (Ghaderi et al., 2026; Pigola & de Souza Meirelles, 2026).

Second, tourism businesses need to rethink cybersecurity strategies as multi-dimensional and interdisciplinary (Ghaderi et al., 2024). For practitioners, this perspective suggests three immediate action areas: (a) organizations should distinguish isolated customer dissatisfaction from coordinated or platform-amplified reputational aggression by assessing repetition, suspicious rating patterns, impersonation, bot activity, and cross-platform escalation; (b) communication strategies should address not only short-term image repair but also harm to legitimacy, credibility, stakeholder trust, and employee confidence; and (c) response protocols should integrate public relations, legal, IT/cybersecurity, and platform-facing functions so incidents are treated as socio-technical and governance risks requiring coordinated action. Traditional cybersecurity measures focusing on data protection and system integrity are necessary but insufficient. Managers must also address narrative and symbolic vulnerabilities, particularly in environments where online visibility and reputation directly affect market performance. This requires closer collaboration between IT departments, communication teams, legal units, and destination governance bodies to develop integrated responses to digital bullying and reputational cyber threats.

Finally, the concept of cyber-symbolic security highlights the importance of proactive monitoring of digital discourse, ethical engagement with platforms, and transparent communication strategies. Tourism organizations should invest in early-detection mechanisms to manage responses to organized online attacks, establish clear protocols for responding to symbolic threats, and engage with platform providers to address algorithmic amplification of harmful content. At the destination level, policymakers and destination management organizations may also consider incorporating symbolic security into broader digital resilience frameworks, recognizing that reputational harm can undermine destination competitiveness and social sustainability as profoundly as technical failures.

In a research-letter format, these recommendations are intended as practical guiding principles rather than a fully specified managerial framework, which would require empirical testing across different organizational and destination contexts. However, this research letter underlines the need for a paradigm shift in how cybersecurity is understood and managed in tourism and hospitality, emphasizing that safeguarding digital infrastructures must go hand in hand with protecting symbolic legitimacy and social trust in platform-mediated tourism systems.

Limitations and Directions for Future Research

Conceptualizing “digital bullying” as cyber-symbolic violence offers a useful analytical lens, but its limits must be acknowledged. Digital bullying, review manipulation, reputational sabotage, and technical cybersecurity incidents should not be treated as a single category, even when they overlap in platform-mediated environments. As a conceptual research letter, this study also does not empirically examine how such harms are perceived, experienced, or managed by tourism stakeholders. Future studies should operationalize cyber-symbolic harms through indicators such as sudden negative-review surges, suspicious rating divergence, coordinated complaints, impersonation, inconsistent content removal, ranking decline, visibility suppression, cross-platform diffusion, and crisis-response labor. These issues could be explored through digital trace analysis, platform analytics, discourse analysis, case studies, and interviews with managers, employees, tourists, and destination stakeholders.

Second, a Bourdieusian framework may be insufficient to fully capture the rapid, ongoing evolution of platform technologies, algorithmic systems, and governance mechanisms. While concepts such as symbolic power and capital offer valuable structural insights, they may struggle to account for the speed, technical complexity, and adaptive nature of platform governance, where rules, algorithms, and moderation practices can change frequently and with limited transparency.

Finally, practitioners may regard this reframing as difficult to operationalize in practice. The emphasis on symbolic power, institutional dynamics, and platform governance does not automatically translate into clear managerial tools, metrics, or immediate interventions for addressing digital bullying. Future research should convert these conceptual insights into empirically grounded instruments, such as incident-typing frameworks, communication playbooks for symbolic harms, and cross-functional escalation protocols for platform-mediated reputational attacks. This limitation can be addressed by combining critical theory with platform analytics, organizational research, and policy analysis. In particular, future studies should examine how symbolic, psychological, and economic harms intersect and how co-regulatory or deliberative governance arrangements can transform critical insights into actionable practice. Research should also develop sharper typologies that distinguish between interpersonal cyberbullying, coordinated reputational aggression, platform-enabled harassment, and technical cyber threats, while exploring how these overlap in tourism and hospitality, and to what extent such vulnerabilities are sector-specific or more broadly platform-driven.