{"id":107374,"date":"2022-12-01T09:44:31","date_gmt":"2022-12-01T17:44:31","guid":{"rendered":"https:\/\/www.backblaze.com\/blog\/?p=107374"},"modified":"2025-12-12T07:05:10","modified_gmt":"2025-12-12T15:05:10","slug":"why-cyberattacks-surge-during-the-holiday-season","status":"publish","type":"post","link":"https:\/\/www.backblaze.com\/blog\/why-cyberattacks-surge-during-the-holiday-season\/","title":{"rendered":"Why Cyberattacks Surge During the Holiday Season"},"content":{"rendered":"

\"\"<\/p>\n

The holiday season should be all about spending some much-needed time off with friends and family, not dealing with cyberattacks at work. But the holiday season is the most wonderful time of year for cybercriminals, too. Cyberattacks surge between Thanksgiving and New Year\u2019s<\/a>. Many businesses and workers may be too busy or distracted to check every security alert or look over every email for suspicious content.<\/p>\n

All businesses should be aware of cybersecurity risks during the holiday season, but small and medium sized businesses face different challenges when it comes to cyberattacks compared with large enterprises. Small businesses (with fewer than 500 employees) comprise 99.9% of all businesses<\/a> in the United States. And microbusinesses, or businesses with four or fewer employees, comprise 91%. Due to their staffing and budget constraints, it is likely they are more vulnerable to cyberattacks than larger organizations.<\/p>\n

Let\u2019s take a closer look at why the holidays are so dangerous when it comes to digital security, and how you can prepare your business for a holiday cyberattack and retain your holiday cheer.<\/p>\n

\n

Download our Ransomware Guide<\/h4>\n

There\u2019s never been a better time to strengthen your ransomware defenses. Get our comprehensive guide to defending your business against ransomware this holiday season.\"\u2794<\/a><\/span><\/span><\/p>\n<\/div>\n

The Most Vulnerable Time of the Year<\/h2>\n

So, why do cybercriminals choose the holiday season to perform their most damaging attacks? Here are a few reasons:<\/p>\n

1. Companies Are Short-Staffed<\/h3>\n

Many companies find themselves short-staffed during the peak of the holiday season. Between holiday travel, events, and obligations, it\u2019s easier for things to fall through the cracks. No matter how much you plan to have a full staff, there will always be times when you wish you had more personnel. End-of-year planning, increased order volumes, more time spent performing customer service duties, and technology hiccups keep staff more than busy at this time of year. Not to mention that there\u2019s an added burden on IT professionals during the holidays, who are busy trying to keep office networks and remote access safe and secure, responding to help tickets, and keeping an eye on increased anomalous activity.<\/p>\n

2. Workers Are Distracted<\/h3>\n

When employees are spread thin and juggling numerous duties and holiday obligations, office duties often take a back seat. Employees are looking forward to the holidays just as much as you are, so you can imagine that they might be more inattentive than at less festive times of the year. Workers that are distracted from their normal cybersecurity awareness might miss a clue that an email is coming from an illegitimate source.<\/p>\n

Cybersecurity activities include scanning for vulnerabilities, mitigating risks, and looking for bad actors moving through systems. Among the hustle and bustle of the holidays, it might seem like there is no time for cybersecurity, or that it can wait till next year. That\u2019s exactly why cybercriminals will be waiting to launch their attack when you least expect it.<\/p>\n

\"\"
Just a little office gift wrapping.<\/figcaption><\/figure>\n

3. Email Activity Increases<\/h3>\n

With so many \u201chappy holidays\u201d emails from vendors, internal employees, and even outside addresses, there are plenty of opportunities for a fraudster to plant a malicious link that goes unnoticed. If a worker falls for a scam on a company device, the entire company could be at risk for a malware attack.<\/p>\n

Cybersecurity Risks During the Holiday Season<\/h2>\n

Ransomware is one of the most damaging threats to businesses of all kinds. Last year there was a 30% increase<\/a> in ransomware attacks targeting companies during the holiday season. When a worker unknowingly clicks on a malicious link or accesses a hijacked website on a company device, the business may become infected with ransomware. Attackers can then hold the organization for ransom<\/a> by threatening to leak information. The advice is generally to refuse to pay.<\/p>\n

Whether your company is in finance, retail, logistics, or any other industry, the first step to getting prepared for the holiday season is to reevaluate your cybersecurity. Ensure that you are ready in case one of these cybersecurity risks hits you this year.<\/p>\n

Phishing<\/h3>\n

Phishing is a popular attack vector that cybercriminals use to gain access to a company\u2019s system. Phishing emails can be very convincing when they impersonate another organization or legitimate person to trick the receiver into divulging crucial login information.<\/p>\n

While many people think they would be able to recognize a phishing email, they\u2019re the entry point for 90% of data breaches. Plus, busy workers may not have the time to focus on the minute details of every message they receive this holiday season. Attackers will use that to their advantage.<\/p>\n

\"\"
A phishing email recently received by the author that came from a false sender address.<\/figcaption><\/figure>\n

Distributed Denial of Service (DDoS) Attacks<\/h3>\n

Another serious threat to business during the holidays is a DDoS attack. This is an especially popular route for cyberattacks at this time of year. Why? Simply put: Because businesses are busy, and attackers are keen to take advantage of that distraction to launch an attack. Cybercriminals use DDoS attacks to overload business systems with so much traffic that none of your applications can function.<\/p>\n

Compromised Passwords<\/h3>\n

The best way for a cybercriminal to gain access to your business websites, accounts, and other mission-critical apps is to obtain compromised credentials. There are many ways that fraudsters can attempt to steal company login credentials with minimal effort. In fact, there have been several well-publicized password-related breaches that made passwords available to anyone who cares to search for that information\u2014people have even created APIs so that you can easily see if you\u2019re affected<\/a> by those breaches. We humans are also prone to reusing passwords<\/a>. According to a 2022 report<\/a>, employees admitted to reusing passwords across an average of 16 different workplace accounts.<\/p>\n

Protect Your Business This Holiday Season<\/h2>\n

So, what can you do to minimize your risks as cybercriminals ramp up their attacks? Here are some tips to help protect your business this holiday season:<\/p>\n