While your IT team is at the beach, threat actors are very much at their desks.
That line isn’t meant to scare you, it’s meant to reflect a pattern Australian CISOs already know too well. December, especially the Christmas-to-New-Year window, is historically one of the most active ransomware and business email compromise periods in Australia. Skeleton crews. Delayed responses. Deferred patching. Relaxed approvals. Attackers understand the rhythm of your business better than you think.
After eight years writing for CTOs, CISOs, and SaaS founders, I’ve seen this cycle repeat itself with uncomfortable consistency. Organisations don’t get breached because they “forgot security.” They get breached because they paused it, just long enough for attackers to slip through.
The Boxing Day breach isn’t an accident. It’s planned.
This article is about what to do in the final 48 hours before the holiday shutdown. Not theory. Not frameworks. Tactical actions that materially reduce risk when your team is thin, decision-makers are offline, and attackers are actively hunting.
- Why December is ransomware season in Australia
- The rise of Adversary-in-the-Middle (AiTM) attacks and MFA bypass
- Australian breaches that followed the holiday pattern
- The 48-hour pre-holiday lockdown CISOs should run
- What to secure so skeleton crews aren’t overwhelmed
1. Why December Is Prime Time for Australian Attackers
Threat actors don’t take holidays. They plan around yours.
December creates the perfect conditions for compromise: reduced monitoring coverage, slower escalation paths, delayed approvals, and a general assumption that “nothing major will happen this week.” For ransomware groups and BEC operators, that assumption is gold.
Australian businesses are especially attractive targets during this window. Many operate with lean security teams, rely heavily on cloud identity platforms, and push change freezes that unintentionally lock in misconfigurations. Add in year-end invoices, supplier payments, and executive travel, and attackers know exactly where to focus.
This isn’t speculation. Incident response firms across Australia consistently report spikes in ransomware deployment, credential abuse, and email compromise attempts between Christmas Eve and mid-January. The goal isn’t subtlety. It’s maximum dwell time with minimal resistance.
Lessons from the Frontline: Australia’s “Summer Slump” Breaches
Every December, the same dangerous assumption creeps in: nothing serious happens while everyone’s away. The reality is the opposite. Some of the most damaging Australian breaches of the past few years didn’t start during the holidays, but they were finished there.
We saw this clearly during the late-2023 surge in Australian SME ransomware attacks. One Melbourne-based logistics firm was hit on December 27. The compromise itself wasn’t new. Attackers had gained access almost three weeks earlier through an Adversary-in-the-Middle phishing link that captured valid session tokens. They waited patiently. When the business slowed between Christmas and New Year, they deployed the ransomware payload.
The timing mattered. The IT manager was the only person with admin rights capable of isolating systems, and he was unreachable while travelling in the Victorian High Country. With no one able to invalidate sessions or shut down lateral movement, the attack spread unchecked, from three servers to thirty-four, before containment even began. The damage wasn’t caused by a lack of tools. It was caused by absence.
A similar pattern played out at a Sydney-based legal tech startup in early January 2024. This time, the entry point was a hijacked session belonging to a senior partner. MFA wasn’t broken,it was bypassed using a valid, stolen session token. Over four days, the attacker quietly downloaded sensitive client documents, operating entirely within what looked like legitimate access.
No alarms were raised because the alerts went to an inbox no one was watching. The breach was only noticed on January 8, when the team returned and saw a week’s worth of “unusual activity” warnings sitting untouched. By then, the data was already gone.
These incidents underline a hard truth many security teams still underestimate: breaches rarely succeed when the door is kicked in. They succeed when the intruder realises no one is home to call the police.
2. AiTM Attacks: How MFA Is Being Bypassed at Scale
One of the biggest shifts heading into 2026 is the rise of Adversary-in-the-Middle (AiTM) attacks, and they’re particularly dangerous during holidays.
In an AiTM attack, the attacker doesn’t steal a password and log in later. They intercept the authentication flow in real time. The victim clicks a phishing link, lands on a convincing login page, completes MFA successfully, and the attacker captures the session token. From the system’s perspective, the login is legitimate.
This is why AiTM attacks now bypass MFA in a significant portion of business email compromise cases. The attacker doesn’t need your second factor, they reuse the authenticated session.
Holiday periods make this worse. Users are distracted. MFA fatigue is higher. Alerts get reviewed later. By the time someone notices suspicious behaviour, the attacker has already created inbox rules, forwarded emails, and harvested internal conversations.
Traditional MFA policies don’t protect against this. Session control does.
3. Australian Incidents That Followed the Holiday Playbook
The Toll Group Ransomware Attack
While not a Christmas Day incident, the Toll Group ransomware attack showed how attackers exploit delayed response and credential compromise to spread rapidly across environments. Once inside, ransomware operators leveraged weak segmentation and limited monitoring to disrupt operations nationwide.
The lesson here isn’t just patching, it’s containment speed. During holiday periods, every extra hour an attacker remains active compounds damage.
Latitude Financial and Social Engineering
Latitude’s breach involved extensive social engineering against service desks and third-party providers. Attackers didn’t rely on malware alone; they manipulated people and processes to gain access. Imagine that same approach during the Christmas break, when temporary staff cover roles and escalation paths are unclear.
Social engineering thrives when verification slows down. AiTM attacks are simply the next evolution of that same trust abuse, automated, scalable, and harder to spot.
These cases underline a critical truth: Australian breaches rarely start with zero-days. They start with credential misuse and delayed response, exactly what holidays enable.
4. The 48-Hour Pre-Holiday Lockdown CISOs Should Run
This isn’t about locking everything down to the point of paralysis. It’s about narrowing the blast radius while your team is thin.
In the final 48 hours before the holiday break, CISOs should focus on five areas.
First, session token control. Force reauthentication for privileged users. Reduce session lifetimes temporarily. Revoke existing sessions where possible, especially for admins and executives. If an AiTM attack captured a token last week, Boxing Day is when it gets used.
Second, email and identity hardening. Tighten conditional access policies. Restrict logins from unexpected geographies. Enable high-sensitivity alerts for inbox rule creation, OAuth app consent, and forwarding changes. These are classic BEC persistence mechanisms that often go unnoticed during holidays.
Third, freeze unnecessary access. Disable dormant accounts. Pause third-party access that isn’t business-critical. Reduce standing admin privileges and enforce just-in-time access wherever possible. Skeleton crews don’t need sprawling permissions.
Fourth, validate backups and isolation. Ransomware operators know holidays mean slower recovery. Confirm backups are immutable, recent, and restorable. Make sure backup credentials aren’t shared with production identity stores.
Finally, define escalation paths that actually work. Who answers the phone if something goes wrong? Who can approve containment actions? Who speaks to legal or customers? Write it down. Share it. Don’t assume people will “figure it out” while they’re away.
5. Designing Security for Skeleton Crews
The goal of a pre-holiday lockdown isn’t perfection. It’s survivability.
Skeleton crews can’t triage thousands of alerts. They need fewer signals, higher confidence, and clear authority. That means prioritising visibility over volume.
This is where many organisations struggle. They have logs, but not context. Alerts, but not reasoning. Activity, but no clarity on whether an action was human, automated, or malicious.
As AI-driven tools and agents become more embedded in operations, this challenge grows. Autonomous systems don’t take holidays, and neither do the mistakes they can make under manipulation. Visibility into who did what, why, and through which session becomes non-negotiable.
Security teams that treat the holiday period as a controlled-risk window, rather than a blind spot, consistently fare better. They limit exposure, constrain trust, and assume attackers are already probing.
Conclusion
The Boxing Day breach isn’t bad luck. It’s the result of predictable conditions that attackers plan for every year.
December will always be risky. Teams will always be lean. People will always deserve a break. The difference between a quiet January and a crisis call comes down to what you lock down in the final 48 hours.
Session control. Identity visibility. Clear escalation. Reduced trust.
If your organisation is looking to strengthen its holiday readiness, especially against AiTM attacks, session abuse, and credential-driven compromise; Aeora Labs works with Australian businesses to bring clarity and control into exactly these high-risk windows. It’s a practical step if you want your security posture to hold when your team is offline
