Seasonal cyber attacks: when businesses are most at risk through the year

Cyber criminals are opportunists, and the calendar gives them plenty of opportunities. Knowing when the pressure points fall lets you prepare instead of reacting.

The short answer: attacks spike around holidays, shopping events, tax deadlines and year-end, and ransomware is often launched when offices are quiet. Plan your cover and reminders around the calendar.

A year of cyber risk

When	What to watch for	What to do
January	HMRC tax-refund and self-assessment scams before the 31 January deadline; post-Christmas phishing	Remind staff HMRC never texts about tax refunds; check any refund email by logging in to HMRC directly
February–March	Year-end invoice and payment fraud; fake “updated bank details” from suppliers	Confirm any bank change by phone on a known number
April	New financial year: payroll and HMRC-themed scams, new supplier set-ups	Extra checks on new payees and payroll changes
May–August	Holiday season: out-of-office replies reveal who’s away; travel and booking scams; thinner cover	Keep out-of-office messages vague; check IT cover over holidays
September	Back to work: password resets, “new system” and training-themed phishing	Refresh security reminders as people return
October–November	Black Friday and delivery scams; event and charity scams	Warn staff about fake deliveries and deals on work devices
December	Fake invoices, delivery notices, e-cards and gift card requests; skeleton staff; ransomware over the break	Confirm IT monitoring over Christmas; test backups beforehand

Why timing matters to attackers

• Fewer eyes. Nights and holidays mean slower detection, so ransomware is often launched then. The FBI and CISA have seen more high-impact ransomware attacks on holidays and weekends (CISA advisory).
• Expected messages. People expect delivery notices in December and HMRC emails in January, so fakes blend in.
• Busy, distracted people click more quickly and check less.
• Changes in routine, such as new suppliers and new staff, create openings.

What has changed since we first wrote this

• AI-made scams for every season. Criminals can now produce polished, personalised seasonal lures in minutes, in perfect English.
• More impersonation. Fake suppliers and fake bosses arrive by email, Teams, text and cloned voice. See phishing email examples.
• Attackers target quiet periods deliberately, so out-of-hours monitoring matters more now.
• Scams arrive in more places. A fake invoice used to come by email; now it turns up in Teams chats and texts too, so staff reminders cover every channel.

How to prepare all year

1. Keep monitoring running out of hours and over holidays, through your IT provider or a managed detection service.
2. Send short, timely reminders before each risky season.
3. Have firm payment rules: no bank changes without a call-back on a known number.
4. Test backups before quiet periods. See business data backup.
5. Know who to call if something happens over a holiday. See incident response plans.

Where an AI agent helps

Two agents cover the riskiest moments of the year:

• The AI Payment-Verification Agent ↗ checks bank details and flags suspicious invoices before money moves, which is useful at year-end and tax time.
• The AI Security-Monitoring Agent ↗ keeps watching over weekends and holidays, when nobody in the office is.

See all our agents in the solutions library on jerait.ai ↗, or find the right agent for your business on jerait.ai ↗.

The catch: the AI an agent runs on is paid for by use. With Jera IT support, your first agent is built, supported and maintained free; we give you a rough idea of the usage cost before you commit, and a real figure from the trial.

How Jera can help

Our security monitoring runs around the clock, holidays included, through an external security operations centre, for businesses across Edinburgh, Glasgow and Aberdeenshire. Before the Christmas break, book a call to talk through who’s watching your systems while the office is shut.