Cyber Attacks During Holidays: Why the Spike?

November 2, 2022
Cayley Wetzig, Head of Marketing Communications

For most people, the holiday season is a long-awaited chance to relax and enjoy time with family and friends. It’s also a time to flock to online stores in search of the best deals on gifts, travel, and more.

Holiday shopping statistics show people are willing to spend more during 2022’s holiday season. Analysts project that online holiday spending will reach $190 billion this season.

With so many people shopping online, cybercriminals see the holiday season as the perfect opportunity to launch attacks. For instance, ransomware attacks increase by 30% during the holidays compared to regular months.

After all, consumers are so focused on finding the best deals and completing their holiday shopping that they may not be as vigilant about cyber threats. And with the FIFA World Cup 2022 now being part of the holiday season, cybercriminals have another opportunity to take advantage of people’s excitement and interest in the event. For businesses, the risk of cyber attacks during holidays means strengthening cyber security measures and being on high alert.

Here is a closer look at cyber attacks during holidays, the added wrinkle of World Cup cyber threats, and how your enterprise can stay safe.

Cybercriminals Follow the Money and the News

The holiday season is cybercriminals’ favorite time of year. With so many people shopping online and using mobile devices to stay connected, cybercriminals have more opportunities to launch attacks. The opportunities include the following:

People Are Distracted

Cybercriminals also know that people are distracted during the holiday season. In a rush to complete other tasks, it’s easy for employees to abandon cyber hygiene or miss signs of cyberattacks.

Human errors lead to 95% of data breaches, and these errors are likely to occur when people are distracted. This means that cybercriminals are likely to carry out successful cyber attacks during the holidays.

Hackers are aware that there is more valuable data to pounce on during the holidays, so a successful attack would be more rewarding. With increased shopping, retailers have more consumer data. It’s no wonder that 24% of attacks target retailers.

Strained Companies' Networks

During holidays, companies’ networks are more strained due to increased traffic, and cybercriminals are aware of this. They also know that most enterprises are unprepared to handle increased traffic. It’s easy to penetrate the networks unnoticed and launch attacks such as distributed denial of service (DDoS).

Increased Effectiveness of Phishing Attacks

Phishing attacks are more likely to be effective during the holiday season because users already receive many unsolicited promotional emails. Cybercriminals exploit this by disguising themselves as credible sources, such as shipping companies or retailers, to gain victims’ trust. Since targets open over 70% of phishing emails, cybercriminals have a good chance of launching a successful phishing attack during the holiday season.

High Chances of Ransomware Success

Between November and January, the number of attempted ransomware attacks increases by 70%. Hackers know that companies are more willing to pay a ransom during the holiday season to avoid losing valuable data or disrupting operations. They also know that companies are more likely to have a lot of money to pay the ransom.

2020 Was COVID - Attacks Followed Suit

The Covid-19 pandemic created different challenges for businesses, pushing them to embrace remote working as the new normal. However, this new normal only accelerated cyber threats.

Cybercriminals found new ways to exploit vulnerabilities as more people used technology to work from home. It was even easier to attack because most organizations did not focus on providing safe cyber spaces for their remote workers.

Attackers also pounced on people’s interest in following corona-related news by creating fake websites about the virus. There was an increase in cases of uninvited or unwanted members accessing virtual meetings due to credential stuffing.

As people continue working remotely, the risk of cyber threats will only grow. A Deloitte report shows that 47% of employees are victims of phishing attacks when working from home. Therefore, organizations wishing to ensure cyber resilience must put the necessary security measures in place.

An Added Wrinkle: FIFA World Cup Cyber Threats

Unlike in previous years when the World Cup is held in the summer, the 2022 FIFA World Cup will take place in November. The decision comes because the host nation, Qatar, is too hot to host the event in the summer. This only means one thing: the FIFA World Cup, which is usually a malware magnet in its own right, will be joining the holiday cyber chaos in 2022.

World Cup Cyber Threats in 2014, 2018

In 2014, anonymous hacktivist groups dubbed #OpHackingCup and #OpWorldCup launched a hacking campaign using DDoS attacks. The cybercriminals were targeting the official FIFA World Cup website, sponsors’ websites, and government organizations in Brazil. The attackers claimed they were retaliating against the Brazilian government for allegedly spending too much money on the World Cup while neglecting its citizens.

The 2018 World Cup was the pinnacle of cybercriminal activity during a World Cup. The event was hit by several cyber attacks, where users were tricked into downloading malware.

The most notable one was an android malware disguised as an app for streaming the event. The app, AndroidOS_DarDesh.HRX, looked legitimate, but hackers only used it to spread malware. Downloading the app installed malware on users’ devices, allowing hackers to perform malicious activities.

Another malware was disguised as a document predicting the outcome of various matches during the tournament. Users automatically downloaded other payloads and scripts from C$C servers when they clicked on the document.

One of the scripts downloaded image files with an extractable file embedded in them. This file acted as a keylogger and could search for sensitive files.

With the 2022 World Cup coming soon, cybercriminals will likely use similar or more sophisticated tactics to launch cyber attacks. Cybersecurity experts have urged people to look out for fraudulent or fake emails and websites that look legitimate. People should be wary of websites offering cheaper tickets or streaming the event live.

Businesses in the aviation, technology and hotel sectors will be at a higher risk of sophisticated attacks, given that they play a crucial role in the event’s logistical success.

How to Avoid Falling Victim of Cyber Attacks During Holidays

An increased risk of cyber attacks during the holidays doesn’t mean that your organization should sit back and do nothing. There are several things you can do to protect yourself from cyber threats. These include:

Training employees to raise awareness about cyber threats to minimize human error
Identify flaws and vulnerabilities in all your organization’s connected devices
Update all your software
Add an extra security layer to your enterprise’s email accounts
Make customer service more accessible to address concerns swiftly
Regularly test your cyber defenses
Have a robust contingency plan

This list is not exhaustive, as you can use other measures to keep your organization safe during this holiday season.

Stay on Top of Cyber Attacks This Holiday Season

2022’s holiday season will probably be one of the most lucrative opportunities for cybercriminals. In addition to the usual holiday attacks, the upcoming World Cup offers hackers another opportunity to harvest data.

But you shouldn’t let cybercriminals ruin your festive season while there’s so much you can do to stay safe. We recommend providing your employees with cybersecurity education to reduce the risk of human errors that lead to issues like phishing attacks.

ThriveDX is ready to provide your enterprise members with the security training they need to survive cyber attacks during the holidays. Our training content is custom-fit, so you can be sure that your team is learning something that will suit your organization. Learn more about our cybersecurity services and solutions and how they can help you enjoy a secure holiday season.

Protect Your Organization from Phishing

Article

9 Most Important Cybersecurity Tips for Your Employees

Organizations are inundated with cybersecurity tips- but what are the most important ones you

Article

8 Mobile Cybersecurity Threats You Should Take Seriously

Between 80 to 90% of mobile apps contain a security vulnerability. Learn about the

Article

Zoom Cybersecurity and Privacy Strategies

Zoom's growth during and after Covid expedited working in remote areas. However, video conferencing

Article

8 Surprising Reasons Hackers Target Schools

Hackers target schools for a number of reasons. To steal research data, learn trade secrets

Your Trusted Source for Cyber Education

Sign up for ThriveDX's quarterly newsletter to receive information on the latest cybersecurity trends, expert takes, security news, and free resources.