As U.S. organizations head into Thanksgiving, Black Friday, Christmas, and New Year, attackers are doing what your finance team is doing: planning their year-end numbers. The pattern repeats annually. The same attacks land harder when offices are thinly staffed, executives travel, change windows are frozen, and transaction systems are at peak load.
The sharper way to frame the risk is this: holiday attack volume does not necessarily spike, but defensive capacity reliably collapses. Attackers do not need more attacks. They need more time before anyone notices. Over a long weekend, they get it.
Why Holidays Create a “Perfect Storm”
- Response capacity drops. Nearly four in five organizations reduce security operations staffing by 50% or more on holidays and weekends, and some stand down entirely. Detection does not stop, but the human triage behind it does, and dwell time stretches.
- Attackers work your calendar. Ransomware operators concentrate initial access, reconnaissance, and staging in off-hours. More than 70% of encryption events observed by Google Threat Intelligence Group occurred between 6 p.m. and 8 a.m., and roughly 30% on weekends.
- Volume masks anomalies. Record e-commerce and payment volume makes anomalies harder to see. Automated traffic now accounts for roughly half of commerce traffic, so the signal you need is buried in noise you expect.
- Change freezes leave gaps open. Freezes are good hygiene for availability and bad hygiene for exposure. Known-exploited vulnerabilities left unpatched “until January” are the ones attackers are scanning for in December.
- Third parties are thin too. Your MSP, payment processor, and SaaS providers are running the same skeleton crews. A holiday incident at a provider becomes your incident, on their response timeline.
What Is Different Going into the 2026 Season
- AI-generated lures are cheap and fluent. Attackers no longer need good English or a convincing template. Holiday-themed lures (shipping exceptions, bonus notifications, gift card programs, travel changes) are now generated at scale and localized convincingly.
- Help desk impersonation is the growth channel. The fastest route past MFA is a person, not a protocol. Voice phishing against service desks to reset credentials or re-enroll MFA has driven some of the most damaging retail and hospitality intrusions of the past two years, including one that began days before a holiday weekend and cost the victim more than $400 million. Verification scripts matter most when your most experienced desk staff are out.
- Commerce is the DDoS and API epicenter. Commerce absorbed the overwhelming majority of Layer 7 DDoS volume last year, and API-directed web attacks continue to climb. Most organizations report an API incident; few can say which APIs expose sensitive data.
- Extortion without encryption. Encryption is increasingly optional. Where backups are strong, extortion shifts to the data itself. A clean restore no longer ends the incident, and legal, PR, and notification paths have to be live over the holiday.
Common Holiday Attack Patterns
The techniques are consistent year to year. The timing is the variable.
- Phishing, smishing, and vishing built on holiday themes: delivery exceptions, payroll and bonus notices, charitable appeals.
- Ransomware staged mid-week and detonated on a Friday evening or the Sunday before employees return, maximizing time before anyone looks.
- Business email compromise aimed at year-end financial flows: vendor banking changes, final invoices, bonus runs, and wire approvals routed to traveling executives.
- DDoS used as a diversion, pulling IT and security attention while a deeper intrusion proceeds.
- Web skimming, card testing, and account takeover against storefronts during peak shopping, where fraud losses hide inside legitimate volume.
The 30-Day Holiday Hardening Plan
Thanksgiving falls on November 26 this year. The window to do this work is now. HALOCK recommends sequencing it over the next four weeks rather than attempting it in the week before the holiday.
Days 1–7: Decide What Matters
- Identify crown-jewel systems, critical third parties, and the people who own them. This is far cheaper to do now than during an incident.
- Answer the forcing question: if you had to run the business for a week on three systems, which three? Those get the rest of the month’s attention.
- Confirm cyber insurance contacts, breach counsel, and whether an incident response agreement is actually in place, not merely discussed.
Days 8–14: Close the Open Doors
- Patch internet-facing systems, prioritizing known-exploited vulnerabilities over raw CVSS score.
- Enforce phishing-resistant MFA for remote access and all privileged accounts. Disable unused RDP and legacy VPN paths outright for the season.
- Review and rehearse service desk identity verification for password and MFA resets. Decide now what proof a caller must provide, and who is authorized to override it.
- Strengthen email authentication (SPF, DKIM, DMARC) and impersonation protection, and require out-of-band verification for any banking or payment change.
Days 15–21: Prove You Can Recover
- Validate that backups are immutable, offline, or otherwise isolated from an attacker holding domain credentials.
- Run a timed restore test of a crown-jewel system. An untested backup is a plan, not a control.
- Confirm logging coverage and retention for identity, endpoint, and remote access. This is the evidence forensics will need.
Days 22–30: Rehearse the Response
- Run a tabletop on the actual scenario: ransomware detonates on the Sunday after Thanksgiving. Who declares an incident at 2 a.m.? Who can isolate a system without waiting for approval?
- Publish the holiday IR playbook: primary and backup on-call, escalation contacts for providers, HR, legal, PR, and executives, and alternate communications if email and Teams are unavailable.
- Set the rule for change freeze exceptions. Emergency security patching should be pre-approved, not debated on December 24.
The forcing question: If you had to run the business for one week with only three systems, which three would they be? If your team cannot answer that in a meeting, that is the first gap to close, before patching, before monitoring, before anything else on this list.
What to Monitor During the Holiday Window
- Identity. Unusual authentication patterns: impossible travel, abnormal login geography, spikes in authentication failures, and repeated MFA prompts suggesting push fatigue.
- Privilege. New members of privileged groups, unexpected role assignments, and admin activity outside normal hours. This is where staging shows up first.
- Email. Mailbox rule creation, auto-forwarding, and delegation changes are reliable early evidence of account compromise feeding a BEC attempt.
- Data movement. Large outbound transfers to unfamiliar destinations, mass file access, and early encryption behavior on file servers.
- People. Tell employees what this season’s scams look like (unexpected bonus or gift card notices, shipping problems, travel changes) and make sure they know how to report one in under a minute, including while out of office.
If You Suspect an Attack
This is the moment the preparation pays for itself. Work the playbook.
- Contain first. Isolate affected systems, disable compromised accounts, and block known-malicious traffic. Stopping spread outranks understanding root cause in the first hour.
- Escalate early. Escalate to leadership and activate incident response support immediately. Early engagement shortens the incident; waiting until Monday does not.
- Preserve evidence. Capture logs, memory, and system snapshots before remediation destroys them. This is the difference between a defensible investigation and an assumption, and it drives insurance and legal outcomes.
- Notify and meet deadlines. The FBI’s IC3 portal and CISA both encourage prompt reporting, particularly for ransomware and BEC, where early notice measurably improves the odds of fund recovery. Track regulatory and contractual notification clocks from the moment of discovery.
Download the Holiday Cyber Readiness Checklist
Print it, assign owners, and date each item as it closes. The one-page checklist covers pre-holiday preparation, monitoring during the holiday window, and what to do if an incident occurs.
Talk to HALOCK Before the Holiday, Not During It
HALOCK’s Incident Response Readiness program puts the agreement, the rate card, and the response team in place before you need them, with a 24x7x365 hotline, a one-hour acknowledgement SLA, and an incident retainer at every tier. Readiness work such as IR plan development, first responder training, runbooks, and tabletop exercises is included as the tier scales.
Incident Response Hotline: 800.925.0559
To discuss readiness tiers or any of the recommendations above, contact your HALOCK account team.
Sources
- Semperis. 2025 Holiday Ransomware Risk Report (November 2025). semperis.com
- Cybersecurity Dive. “Thanksgiving holiday weekend kicks off heightened threat environment for security teams”. cybersecuritydive.com
- Google Threat Intelligence Group. Ransomware encryption timing analysis, cited in Cybersecurity Dive. cloud.google.com
- FBI Internet Crime Complaint Center. 2025 Internet Crime Report. ic3.gov
- Akamai. State of the Internet: Securing the Agentic Storefront — Attacks on Commerce (2026). akamai.com
- RH-ISAC. Holiday threat preparation guidance for retail. rhisac.org
- CISA. Holiday and weekend ransomware preparedness guidance. cisa.gov
