Before the Shop Closes for the Holidays

The plant manager at an 80-person metal fabricator locks the front door on December 23rd. The machines are cleaned, the floor is swept, and everyone is off until January 2nd. It has been a good year.

On the 27th, something gets into the office network. Nobody notices, because nobody is there. It spends four quiet days working through the file server and the backup drive sitting next to it.

On January 2nd, first shift arrives to a time clock that will not load, a scheduling system that shows a ransom note, and a list of customer orders that is now a week behind before the year has started.

Most companies plan their holiday shutdown carefully for the equipment. Very few plan it for the computers.

Why the holidays are when it happens

This is not a hunch. In a joint advisory, the FBI and CISA (the federal agency responsible for cybersecurity) said they had seen an increase in highly damaging ransomware attacks on holidays and weekends, when offices are normally closed.

The reason is simple. An attack that is caught in the first hour is a bad afternoon. An attack that runs unnoticed for a week is a disaster. Criminals know that a closed business gives them days instead of hours.

The advisory's examples were not small. One attack over Memorial Day weekend stopped production completely at meat processing plants in the United States and Australia.

A year-end shutdown is the longest stretch most operational businesses go without anyone looking at their systems. That makes it worth an hour of planning in November.

What actually goes wrong

Nobody is watching, and nobody is reachable. Alerts go to an inbox that nobody opens until January. The one person who knows the passwords is on a cruise. The IT provider's after-hours number is on a sticky note in the office that is now locked.

The backup quietly stopped weeks ago. A backup that failed on December 10th and was never checked is the most common surprise of all. You find out on the day you need it.

The backup was in harm's way. If the only copy sits on a drive plugged into the same network, whatever damages the server can damage the backup too. This is the difference between a two-day recovery and starting from scratch.

Every door was left open. Remote access for people who will not use it for two weeks. Accounts for seasonal staff and people who left in the fall. Each one is a way in that nobody will miss.

Payments still go out. A skeleton crew in accounts payable is exactly who a fake "updated bank details" email is aimed at. We covered how those requests work in AI voice scams in accounts payable.

The restart is nobody's job. Even without an attack, a power blip over the break can leave a server that will not boot, a label printer that lost its settings, or a shop-floor computer that decides to install a large update at 6 a.m. on the first day back.

What good looks like

None of this requires a big project. The businesses that come back cleanly in January have a few simple things in common.

A named person on call. Someone specific, with a phone number that works, who knows what to do if an alert fires on the 28th. It can be your IT provider, but you should know who it is and test the number.

A backup they have actually tested. Not "the light is green." Someone picked a real file, restored it, and opened it within the last few weeks. At least one copy lives somewhere an attack on the office cannot reach.

Fewer ways in while the building is empty. Accounts for people who left are switched off. Remote access is limited to the people who genuinely need it over the break, and every one of them uses MFA (the extra code you get on your phone when you sign in).

A pause on payment changes. No vendor bank account gets changed until the full team is back, no matter how urgent the request sounds.

A plan for the first morning. Someone comes in early on the first day back and checks the important systems before the shift arrives.

It is also worth saying what you do not need. You do not need to buy anything new for a two-week break. If the basics above are in place, most businesses are in good shape.

What to do about it this month

Pick the on-call person and write it down. Put their name, cell number, and your IT provider's emergency line on paper. Give a copy to the owner and the plant manager. Paper still works when the computers do not.

Test a restore before the last week. Ask whoever runs your backups to restore a real file from the server and show you it opens. If that cannot be done, you have learned something important with time to fix it. Our backup and disaster recovery page explains what a copy that survives an attack looks like.

Install updates a week early. Run updates on the servers and office computers about a week before the shutdown, not the last afternoon. That leaves time to fix anything that breaks while people are still around.

Close the doors you will not use. Switch off accounts for anyone who has left. Review who has remote access and remove it for anyone who will not need it until January.

Tell accounts payable about the payment freeze. Put it in writing: no changes to vendor bank details until the full team returns. Any request that cannot wait gets a phone call to a number you already had on file.

Keep your insurer's claims number handy. If you have cyber insurance, find the number you are supposed to call first and add it to the paper list. Many policies expect a call before you hire anyone to help. Our post on cyber insurance renewal questions covers what those policies usually ask for.

Plan the restart. Decide who arrives first on January 2nd and what they check: the server, the scheduling or ERP (business management) system, the time clock, and the printers. Fifteen minutes before first shift beats an hour of confusion after it.

A calm January starts in November

Most of this list takes an afternoon. The hard part is that nobody owns it, so it waits until the week everyone is trying to finish orders and leave.

If you would like a second set of eyes, our free IT assessment includes a look at your backups, remote access, and who gets the call when something goes wrong. You will leave with a short list of what to fix before the doors close, and what is already fine.