Holiday Season Cybersecurity: What Orange County Businesses Should Do Before the Break

The weeks between Thanksgiving and New Year’s are the busiest of the year for a lot of Orange County businesses — distributors pushing orders out the door, manufacturers closing out the year, everyone chasing invoices. They’re also when the people who would normally catch a strange email or an alert at 2 a.m. are on vacation. Criminals plan around that. Here’s what tends to go wrong in the holiday season and what to lock down before your office closes.

Why attackers like the holidays

It isn’t the tinsel; it’s the staffing. In a joint advisory, the FBI and CISA warned that criminals view holidays and weekends — especially holiday weekends — as attractive timeframes for ransomware. The advisory lists three 2021 attacks that each landed on a holiday weekend: a fuel pipeline operator over Mother’s Day weekend, meat processing plants in the U.S. and Australia over Memorial Day, and hundreds of organizations — including IT providers and their customers — through an IT management tool over the Fourth of July.

The pattern hasn’t changed. An attack that starts on a Friday afternoon before a long weekend can run for three or four days before anyone notices. By then, files are encrypted, backups may be gone and data has already left the building.

The scams that peak in November and December

Fake invoices and changed bank details

Business email compromise is still the most expensive cybercrime aimed at companies. The FBI’s Internet Crime Complaint Center received 24,768 business email compromise complaints in 2025, with $3.046 billion in reported losses. Californians filed 116,414 complaints that year across all types of cybercrime, reporting $3.67 billion in losses.

The holiday version is simple: a vendor’s real email account gets broken into, and a message arrives asking you to send this month’s payment to a “new” bank account before year-end. For a distributor paying dozens of suppliers, or a manufacturer paying for raw materials and freight, a single redirected payment can be one of the largest checks you write all month. The fix isn’t technical. The FBI’s advice is to use a second channel to verify any request to change account information — call the vendor at a number you already have, not the one in the email.

“Can you pick up some gift cards for me?”

A text or email that looks like it’s from the owner or a manager asks an employee to buy gift cards for a client gift or a holiday party, then send the card numbers. The FTC’s answer is short: gift cards are for gifts, not for payments. Tell your team now, before the first one arrives, that nobody at your company will ever ask for gift cards by email or text.

Delivery notices that aren’t

Shipping and receiving teams get real tracking emails all day in December, which makes fake ones easy to click. The U.S. Postal Inspection Service says USPS won’t text or email customers unless they first requested it with a tracking number, and those messages won’t contain a link. The same rule works for every carrier: don’t follow the link; type the carrier’s address into the browser or check the tracking number in your own shipping system.

Emails with perfect grammar

Typos used to be the giveaway. Not anymore. Ahead of the 2025 holidays, the FBI’s Phoenix office warned that AI-written phishing now arrives with “perfect spelling, perfect language”. Train people to judge the request, not the writing: urgency, secrecy, a new payment method or a login page they didn’t expect.

What’s different for manufacturers and distributors

Over 40% of our clients make or move things, and the holidays hit them differently than an office-only business:

• The year-end push. More orders, more freight and more supplier payments mean more chances for a fake invoice to look normal.
• Seasonal and temporary staff. New people on the warehouse floor and in shipping get accounts quickly and training last. Give them only the access they need, and turn their accounts off the day they leave.
• Shut-down weeks. If the plant closes between Christmas and New Year’s, computers on the shop floor and the ERP server still run. Someone needs to be watching them.
• Shared logins. A shop-floor PC with one shared account and no multi-factor authentication is an easy way into the rest of the network.

Your pre-holiday checklist

Most of this takes an afternoon. Do it before Thanksgiving if you can, and no later than the week before your office closes.

1. Write down the payment-change rule. Any change to bank details gets a phone call to a known number and a second person’s approval. No exceptions in December.
2. Tell everyone about gift card requests. One short email from the owner: “I will never ask you to buy gift cards.”
3. Check MFA on every account that matters — email, banking, payroll, remote access and admin accounts.
4. Check your email domain records. SPF, DKIM and DMARC stop criminals from sending email that looks like it came from you. Our free email security check grades yours in seconds.
5. Install updates before the break, not after. Unpatched systems and remote access are how many holiday ransomware attacks start.
6. Test a restore. Don’t just confirm backups ran — restore a file and a server, and make sure at least one copy is offline or can’t be changed. See how we handle backup and disaster recovery.
7. Clean up accounts. Disable former employees, finished temps and vendor logins nobody uses.
8. Decide who answers an alert on December 26. Name the person, the backup and the phone numbers — including your bank, your cyber insurer and your IT provider — and put them on paper, not only in email.
9. Know what to do if money goes out the door. Call your bank to recall the transfer, then report it at ic3.gov. The FBI says time is of the essence.
10. Give people a quick refresher. Five minutes at the holiday lunch beats a ransomware recovery. Our free Spot the Phish quiz is a good start.

Who’s watching while you’re out?

This is the question that matters most over the holidays. If your IT coverage is one person who’ll also be at the in-laws’ house, an alert on Christmas Eve may sit until January.

At CAL IT Group, our NOC & SOC monitor client systems 24×7×365, and an engineer from the same local team is on call for emergencies on nights, weekends and holidays. Email security — filtering, SPF, DKIM and DMARC set up and enforced, and a help desk your team can call when a message looks wrong — is part of every Managed Care plan, along with security awareness training and managed detection and response. Learn more about our work with manufacturers and distributors.

Check your email security free Call 866.24.CALIT

Sources: FBI and CISA, Joint Cybersecurity Advisory AA21-243A, “Ransomware Awareness for Holidays and Weekends” (August 31, 2021); FBI Internet Crime Complaint Center, 2025 Internet Crime Report; FBI, “Business Email Compromise: The $55 Billion Scam” (September 11, 2024); Federal Trade Commission, “Your boss isn’t emailing you about a gift card” (September 8, 2021); U.S. Postal Inspection Service, “Smishing”; Arizona’s Family, FBI Phoenix holiday scam warning (December 10, 2025).