On 26 November 2008, young waiter Arjun reports for work at the Taj Mahal Palace Hotel in Mumbai, India, under head chef Hemant Oberoi, who reminds his staff that “Guest is God”. The day’s guests include British-Iranian heiress Zahra Kashani and her American husband David, with their infant son Cameron and his nanny Sally, as well as ex-Spetznaz operative Vasili.
That night, 10 terrorists who were part of terror outfit Lashkar-e-taiba, directed by a man known as “the Bull”, launch a coordinated assault against 12 locations across Mumbai, including the hotel. As the local police are not properly trained or equipped to handle the attack, they can only wait for special forces to arrive from New Delhi. In the ensuing chaos, Arjun, David, Zahra and Vasili are trapped in the hotel restaurant with several other guests while Sally, unaware of what is going on, remains with Cameron in their hotel room.
David sneaks past the terrorists and successfully reaches Sally and Cameron. Arjun follows Oberoi’s instructions and escorts the guests under his care to the Chambers Lounge, an exclusive club hidden within the hotel, where they hope to remain safe. David, Sally and Cameron attempt to regroup with them, but David is captured by the terrorists at gunpoint while Sally and Cameron are trapped in a closet. As a hostage David is tied up on the floor in a separate room.
Meanwhile, police officer DC Vam and his partner decide to enter the hotel in the hopes of reaching the security room so they can track the terrorists’ movements. Arjun attempts to escort a mortally wounded guest, Bree, off the premises so she can reach a hospital. The two encounter the police but Bree panics and flees, only to be shot dead by a terrorist. Arjun escorts the police to the security room, and they discover the terrorists are about to break into the Chambers Lounge using the identification of a policeman they killed earlier. The police officer DC Vam orders Arjun to stay put as he goes to attack the terrorists, successfully wounding one before being driven off. Against Oberoi’s advice, Zahra and Vasili decide to leave the lounge to escape, but they are also caught and taken hostage. The terrorists force Zahra and Vasili at gunpoint to join their other hostages (including David), all of whom are lying trussed up on the floor. Before long, Zahra and Vasili are similarly tied up and Zahra joins her husband, David, on the floor with her hands tied behind her back.
Eventually, India special forces arrive, and the Bull orders the terrorists to move to the final phase of their plan: burning the hotel down. The terrorists leave their wounded member, Imran, to guard the bound hostages at gunpoint. But Bull eventually tells Imran to kill all the hostages, who remain powerless on the floor with their wrists secured behind them. Imran shoots both David and Vasili, but spares Zahra when she begins reciting a Muslim prayer, ignoring the Bull’s command to shoot her regardless. No longer a hostage, Zahra manages to untie herself and escape.
Arjun regroups with Oberoi and evacuates the remaining guests, stumbling upon Sally and Cameron in the process. The special forces kill the remaining terrorists, and Zahra is evacuated by an Aerial Work Platform, reuniting with Sally and Cameron. After the hotel is secure, Arjun returns home and reunites with his wife and daughter.
A closing script reveals that those responsible for planning the attack remain free to this day, but the hotel was repaired and parts reopened within months of the event. The final scenes show a memorial to the staff and guests who fought in the Battle of Hotel Mumbai, and footage of the grand reopening of the hotel, 21 months later.