Top Five Cyber Security Tips for the Festive Season

As people start getting in the festive spirit for Thanksgiving and Christmas, the New Year and Hogmanay, it’s easy for employees in all organisations to lower their guard and overlook essential cyber security practices. It’s a huge time of the year for buying gifts, too, of course, and the festive season is also the biggest shopping season in the UK and North America.

But as the festivities get underway and people take more time off to spend with family and friends, cybercriminals become even more active. Cyber threats typically spike due to reduced staffing, increased online activity, and seasonal social engineering.

So, without further ado, let’s unwrap the most common threats facing organisations at this time of year. We’ll also outline practical steps and proven strategies to help you to counter them and make the winter holiday season safe and secure.

1. Increased phishing and social engineering scams

The holiday season is prime time for phishing attacks as attackers know teams may be distracted or short-staffed. Common themes include:

Fake delivery notifications (Royal Mail, DHL, Amazon)
Holiday promotions or gift card scams
End-of-year invoice or payment request.

What you can do:

Run phishing reminders/awareness training for employees and contractors
Enable strong email filtering
Require multi-factor authentication (MFA) on all accounts.

2. Reduced staffing and delayed incident response

With staff on annual leave, incident detection and response times drop, giving attackers more opportunity to escalate an intrusion.

How you can mitigate risks:

Establish an on-call or rota-based incident escalation plan
Review holiday coverage for security and IT teams
Pre-approve emergency change management procedures.

3. Weak remote access controls

More employees working remotely over the holidays increases risk.

What actions you should take:

Enforce MFA on virtual private networks (VPNs) and remote desktop services
Disable unused remote access accounts
Monitor unusual login locations or login timings
Ensure patches for VPN appliances and firewalls are up to date.

4. Rushed end-of-year procurement and shadow IT

Holiday sales can lead to teams signing up for tools or software at short notice, without conducting a full security review.

How to reduce risk:

Remind staff to route all new software or service requests through IT/security
Review access privileges for newly created accounts
Ensure third-party risk and data-sharing implications are considered.

E-commerce and payment fraud spikes (for customer-facing businesses)

This is the most targeted period of the year for organisations processing online transactions.

5. Steps to take today:

Monitor for web skimming / Magecart-style attacks
Validate PCI-DSS controls
Use bot detection and velocity checks on payment systems
Check for domain spoofing and typosquatting.

Cybercriminals never stop. At Quorum Cyber neither do we. Every day of the year, our 400-strong team is ready to help defend your organisation before, during, and after any cyber-attack.

Insights