26% of hospitality industry cyberattacks included credential access