The email lands at 4:40 on the Friday before a long weekend. It looks like a delivery notice, it is addressed to someone in accounts payable, and it asks for one quick confirmation. In a normal week, that person reads it twice. With most of the office already gone and one colleague covering three desks, it gets a click, a login, and a download.
Nothing about that story is exotic. What makes it more likely in late December, around a national holiday, or on the eve of a three-day weekend is arithmetic. Fewer people are watching, decisions take longer, and the people who are working are doing more with less attention to spare. Ransomware crews read the same calendar everyone else does.
Why the quiet weeks are the attractive ones
Most intrusions are not caught by a siren. They are caught by a person who knows what normal looks like noticing that something is not normal: a login from an odd country, a service account behaving like a human, a backup job that stopped reporting. On a Tuesday morning with a full team, that gets flagged in minutes. On a holiday weekend with two people on shift, the same oddity has hours to look unremarkable.
Time is the whole point. Once inside, an attacker wants quiet hours to map the network, find the domain controller, locate or destroy the backups, and copy data out before anything gets encrypted. Ransomware is often the last step, not the first, and it is preceded by days of patient looking around. A long weekend hands that patience a gift.
The staffing gap is really a decision gap
Technical containment is rarely the bottleneck. Someone on call can usually pull a network cable. The hard part is the call that costs money or stops the business: isolating a production line, shutting down the ERP system, waking the chief financial officer at 2 a.m., authorising emergency spending on incident response.
Those decisions belong to people, and on holidays those people are often travelling, asleep, or unreachable. Every hour spent hunting for a signature wastes the only resource that matters. Before the calendar gets thin, settle these questions:
- Who is authorised to isolate or shut down systems outside business hours, and who is their deputy?
- What is the pre-approved spending limit for emergency response, and who can release it?
- At what point does the on-call technician stop investigating and start escalating?
- Which phone numbers still work when the ticketing system does not?
The change freeze trap
Many organisations freeze changes over the holidays to protect stability. The instinct is sound; the side effects are not. Patching pauses, access reviews slip, and every "we will clean that up in January" item stays open through the exact window when nobody is looking at it.
What accumulates while nobody is watching
- Software updates deferred for weeks, including ones fixing flaws that are already being exploited elsewhere.
- Temporary accounts created for seasonal staff or contractors and never removed.
- Offboarding left half-finished because someone's last day fell between two holidays.
- Vendor and remote-access credentials that were meant to be reviewed in November.
- Backup verification quietly skipped because "nothing changed this week".
None of these create an attack by themselves. Together they widen the doorway at the moment the building is emptiest.
A holiday readiness checklist you can finish in a day
- Print the essentials. Contact list, escalation tree, key vendor numbers, and the incident response plan on paper. If the network is encrypted, your runbook should not live only on the network.
- Test the escalation path, do not assume it. Call the on-call number on a Saturday evening and see how long it takes a human to answer. Measure it, then fix what fails.
- Name a decision-maker for every shift. Cover the whole holiday period, not just the first night, and make sure that person knows they hold the authority to act.
- Prove one restore. Pick a file, restore it from an offline or immutable copy, and confirm the copy was not reachable from the production network.
- Close the easy doors. Turn on multi-factor authentication for remote access and email, disable dormant accounts, and remove access for anyone who no longer needs it.
- Reduce the on-call load. A single person covering three roles will not notice subtle anomalies. If you can spread the shifts, do it.
- Pre-write the first hour. Isolate, preserve evidence, do not power down systems unnecessarily, notify the named contacts. Keep it to one page.
- Line up outside help in advance. Know which incident response firm you would call, who your legal contact is, and how your insurer wants to be notified.
Rehearse the first hour, not the whole disaster
A full crisis simulation is overkill for most teams in December. A forty-five minute conversation is not. Gather the people who would actually be involved, read out one scenario, and talk it through: the file server is encrypted, the phones are ringing, half the staff are away. Who does what in the first sixty minutes? Who calls whom? What do you tell employees, customers, and the person who wants to pay?
The gaps appear fast, and they are usually about contact details and authority rather than technology. Finding those gaps in a meeting is far cheaper than finding them at midnight.
If a plan has never been read aloud by the people who have to follow it, it is a document, not a plan.
Make the next long weekend boring
Seasonal spikes are not mysterious. They follow attention, and attention thins out on schedule. The defence is equally predictable: fewer open doors, faster escalation, and people who already know what to do.
Start small this week. Print one page of contacts. Test one on-call number. Restore one file. Assign one decision-maker per shift. That is a realistic afternoon of work, and it changes the odds more than another tool you will not have time to configure.
One note on the parts that carry real consequences: insurance terms, breach notification duties, and legal obligations vary by contract and jurisdiction. Confirm your own arrangements with your insurer and legal counsel rather than relying on general guidance, including anything here.
Photo: derschoeneali / Pixabay
