Why Cyberattacks Spike During Christmas and New Year, and How to Protect Your Business

Christmas cyberattacks do not happen because criminals observe a neat holiday calendar. They happen because the conditions around the shutdown make ordinary attacks easier to miss. Fewer people are watching shared inboxes, senior staff are harder to reach, suppliers change payment dates, and employees are keen to clear urgent requests before leave. Attackers use that disruption.

We help Victorian businesses prepare for this period as part of looking after their everyday IT. In this guide, we explain why the risk changes, what to check before the office closes, how to handle an incident with a smaller holiday team, and what to review when everyone returns. The aim is not to frighten anyone. It is to remove the gaps that make a routine phishing email or stolen password more damaging than it should be.

Why does the holiday period change the risk?

Most Christmas cyber attacks still begin with familiar methods: a convincing email, a reused password, an unpatched device or an account with more access than it needs. What changes is the business around those weaknesses.

The following pressures often arrive together:

• Reduced coverage: the person who normally checks a strange invoice or login alert may be away.
• Urgent payments: altered trading dates can make an unusual transfer request seem plausible.
• Temporary access: casual staff, contractors and people working from home may need short-term permissions.
• Delayed updates: teams sometimes postpone restarts or maintenance until after the busy period.
• Slower escalation: staff may hesitate to call a manager who is on leave.
• Public absence information: automatic replies and social posts can reveal who is unavailable and for how long.

None of these conditions proves an attack will occur. Together, however, they reduce the checks that normally catch one. That is why we plan for the operating pattern, not simply the date.

Which attacks should a business expect?

The names can become technical, but the practical patterns are easy to recognise. Before a shutdown, we talk staff through the requests they are most likely to see and the second channel they should use to verify them.

This table is useful because Christmas cyber attacks rarely announce themselves with poor spelling and an obviously false sender. A compromised supplier account may send a message inside a real conversation. Process is more dependable than instinct.

Our pre-shutdown security checklist

We prefer to finish the important work before the last afternoon. A hurried checklist performed while people are packing up is likely to miss the account nobody remembered or the backup nobody tested.

• Confirm ownership and escalation

Every alert needs an owner. We record who can make decisions during the closure, who has authority to approve payments, and how staff can reach the right person. We also make sure external support has current contacts rather than an old mobile number in a forgotten document.

• Review accounts and permissions

We disable accounts that are no longer required, review privileged access and set expiry dates on temporary permissions where the platform allows it. Shared administrator logins are difficult to trace and should be replaced with named accounts.

Multi-factor authentication should protect important services, especially email, remote access and administration. The Australian Signals Directorate includes multi-factor authentication, patching, restricted administrative privileges and regular backups in its Essential Eight.

• Patch the systems that matter

We identify internet-facing systems, business applications, operating systems and network equipment that need updates. A maintenance window before the break is useful, but it needs testing and a rollback plan. Installing everything blindly on the final day can create a different kind of outage.

• Check backups by restoring something

A green dashboard is encouraging; a successful restoration is evidence. We confirm that backups cover the data and systems the business expects, that at least one protected copy cannot be casually altered through the normal network, and that the right people know how recovery begins.

• Reduce unnecessary exposure

Remote services, dormant accounts and temporary vendor access should not remain open merely because they might be convenient. We document what must stay available and close or restrict the rest.

A practical seven-day run-up

A timetable makes the work manageable and gives staff time to raise questions.

1. Seven days before: confirm leave coverage, suppliers, critical systems and incident contacts.
2. Five days before: finish account reviews, urgent patches and backup checks.
3. Three days before: brief staff on payment changes, suspicious logins and reporting.
4. Two days before: test alert routing and confirm the on-call person can access what they need.
5. Final day: close temporary access, secure unattended equipment and record system status.
6. During closure: review agreed alerts and record any action taken.
7. First day back: examine unusual logins, mailbox rules, new accounts and missed alerts.

How should staff verify an unusual request?

We give people a simple rule: pause, use a trusted second channel and report the request. If an email changes bank details, call the supplier using the number held in the accounting system. If a manager asks for an urgent transfer, confirm it by phone or an established internal channel. Do not reply to the same message and treat that as verification.

Staff also need permission to slow an apparently urgent request. A process that punishes reasonable checking teaches people to comply quickly. Clear approval thresholds and two-person checks for sensitive changes are business controls as much as technical ones.

What should happen if something looks wrong?

Speed matters, but evidence matters too. If a device behaves unusually or an account appears compromised, disconnect the affected device from the network where practical and call the nominated support contact. Do not delete emails, wipe the computer or conduct an improvised investigation.

The first response should cover:

• what was observed and at what time
• which person, account, device or payment is involved
• whether credentials were entered or a file was opened
• whether money or sensitive information may have moved
• who has been notified
• what containment action has already occurred

Why managed support helps during a shutdown

Technology does not become simpler because the office is quiet. Logs, alerts, backups and cloud accounts still need an agreed level of oversight. Our IT support services can help a business define that coverage and remove uncertainty about who acts when something goes wrong.

For clients using our managed IT services in Melbourne, holiday preparation sits within year-round management: devices are known, maintenance is scheduled, access is reviewed, and recovery responsibilities are documented. That context is much more useful in an incident than meeting the environment for the first time.

This does not mean outsourcing business decisions. Management still decides priorities, payment authorities and acceptable downtime. We make sure the technology and escalation path support those decisions.

What we review in January

The return to work deserves its own check. We look for accounts created during the break, forwarding rules in mailboxes, unexplained login locations, failed backup jobs and devices that missed updates. We also close temporary permissions and capture anything the holiday team learned.

Christmas cyber attacks are one reason to do the review, but not the only one. The exercise often finds ordinary housekeeping that would otherwise follow the business into the new year.

Talk the shutdown plan through with us

The right plan depends on how your Victorian business operates, which systems cannot stop and who will actually be available. We have supported businesses from our Ashburton base for more than 25 years, and we keep the conversation practical.

Call us on 1300 414 214 before the holiday rush. We can review the current setup, identify the few gaps that matter most and agree on a clear response path for the closure.

Frequently asked questions

1. Do Christmas cyber attacks only affect large companies?

No. Smaller businesses can be attractive because approval processes and holiday coverage may be informal. The controls should be proportionate, but every business needs protected accounts, usable backups and a way to report suspicious activity.

2. Should we switch every system off?

Not automatically. Some services need to remain available, and an uncontrolled shutdown can interrupt backups or remote management. We document what can be switched off, what must stay running and who monitors it.

3. Is an automatic reply a security risk?

It can disclose absence dates, roles and alternative contacts. Keep the message useful without publishing unnecessary internal detail, and avoid directing unknown senders to another person’s private contact information.

4. Is cyber insurance enough preparation?

Insurance may help with some consequences, subject to its terms, but it does not replace prevention or an incident plan. Insurers may also require particular controls and prompt notification, so the policy should be reviewed before an event.