Attackers Like Holiday Weekends. Who Watches Your Data When the Office Closes?

The quiet week is not quiet for everyone

Thanksgiving falls on Thursday, November 26 this year. Christmas Day and New Year's Day both land on a Friday. That gives many Oklahoma offices a four day weekend followed by two three day weekends in a row.

Staff deserve that time off. The problem is that the people who attack company data know the calendar too.

What the FBI and CISA have said

In a joint advisory titled Ransomware Awareness for Holidays and Weekends, the FBI and the Cybersecurity and Infrastructure Security Agency said they had seen an increase in highly impactful ransomware attacks on holidays and weekends, when offices are normally closed. They said the timing gives attackers a head start, because defenders and IT support are at limited capacity for an extended time.

The advisory gave three examples from 2021. An energy company was hit leading into Mother's Day weekend and shut down operations for a week. A meat producer was hit over Memorial Day weekend and production stopped completely. Over the Fourth of July weekend, attackers went after an IT company's remote management tool and reached hundreds of organizations, including service providers and their customers.

The agencies recommend that companies name IT security staff who will be available and on call during these times.

The numbers still point the same way

In November 2025, the security company Semperis released a survey of 1,500 IT and security professionals in 10 countries, including the United States. Of the organizations that were hit by ransomware, 52 percent said it happened on a holiday or weekend. The survey also found that 78 percent of companies cut their security staffing by half or more on holidays and weekends, and 6 percent cut it entirely.

Why do companies cut back? In the same survey, 62 percent said they wanted to give staff a real break, 47 percent said their business is closed and 29 percent said they did not think they would be attacked.

Closer to home, the FBI's 2025 Internet Crime report for Oklahoma lists 39 ransomware complaints from Oklahoma victims. Those are only the cases people reported to the FBI.

Why this is a data problem, not only an IT problem

Ransomware goes after the data you cannot run without. The advisory says attackers often copy data out before they lock it, then threaten to publish it. It also says some of them go after backups first, so you cannot restore.

That means the people who know your data matter as much as the people who know your network. Someone has to know which database holds customer records, how long a restore takes and what a normal night of activity looks like. The advisory lists a big jump in database reads and logins at odd hours or from odd places as warning signs. You can only spot those if you know your normal.

A simple plan before Thanksgiving

1. 1Write down who is on call for each holiday weekend, with a backup person, and make sure both have the access they need from home.
2. 2List the alerts that must reach a real person day or night, such as failed backups, new admin accounts, large data exports and logins from unusual places. Send everything else to the Monday queue.
3. 3Restore one important database or file share from backup and record how long it took.
4. 4Keep at least one recent backup copy offline or locked so it cannot be changed or deleted from your network.
5. 5Check every way into your systems from outside. Remote desktop should sit behind a VPN with a second sign in step, and unused remote access should be turned off.
6. 6Ask your outside vendors and IT providers who covers your account over the holidays and how they reach you.
7. 7Put the phone numbers for your bank, your insurer, your IT provider and the local FBI field office on paper, in case email is down.

What this means for Oklahoma business and IT leaders

You do not need a large security team to cover the holidays. You need a short list of what matters most, a person who owns each piece and proof that your backups work. Most of that can be done in a week.

Start with the system that would hurt the most if it went dark on Christmas morning. Know where its data lives, who can restore it and how long that takes. Then do the next one.

At Oklahoma Data Partners, we work only with data and only in Oklahoma. We help companies map where their important data lives, set up backups they have actually tested and build simple checks that show when something looks wrong. If you want your data covered before the holidays, book a consultation.