Topic starter
25/06/2026 12:04 am
TL;DR: 52% of organisations were targeted on holidays or weekends, while 60% saw attacks after mergers, acquisitions, IPOs, or layoffs, and 78% cut SOC staffing by half or more during those periods, according to Semperis. Reduced staffing and governance ambiguity create the conditions ransomware groups exploit.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “NEW Semperis Study Reveals that the Majority of Ransomware Attacks Continue to Occur During Holidays and Weekends”.
By the numbers:
- 52% of surveyed organisations were targeted on holidays or weekends, according to Semperis research.
- 78% of companies cut SOC staffing by 50% or more during holidays and weekends, according to Semperis research.
- 6% cut their SOC staffing entirely during holidays and weekends, according to Semperis research.
Key questions
Q: What breaks when SOC staffing drops during holidays and weekends?
A: Detection still works on paper, but response slows because the people who can validate alerts, revoke access and coordinate recovery are not fully available.
Q: Why do mergers, acquisitions, and layoffs increase ransomware risk?
A: These events create ownership confusion, delayed access cleanup, and temporary permissions that outlive their purpose.
Q: How can organisations tell whether ITDR is actually helping against ransomware?
A: Look for whether identity detections are followed by enforced containment, named ownership and recovery completion.
Practitioner guidance
- Define off-hours containment ownership Assign named decision-makers for account disablement, privileged session termination and recovery approval during holidays and weekends, with clear delegation if the primary owner is unavailable.
- Pre-stage event-driven governance playbooks Create separate response runbooks for mergers, acquisitions, IPOs and layoff periods so access changes, escalation paths and exception approvals do not depend on informal coordination.
- Test identity response under reduced staffing Run exercises that simulate holiday coverage, including delayed triage, delayed approval and limited recovery staff, to see whether ransomware containment still works under realistic pressure.
Bottom line: Ransomware operators benefit when defenders are least available to validate, revoke and recover, which turns holidays, weekends and corporate transitions into predictable risk windows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:53 am
Off-hours staffing is an identity governance decision, not just a SOC scheduling choice. When holiday or weekend coverage drops, the organisation is implicitly accepting slower identity revocation, slower approval paths and slower containment. That makes the coverage model part of the attack surface, not merely an operating preference. Practitioners should treat low-coverage periods as a defined control state with explicit identity response ownership.
A question worth separating out:
Q: Should organisations change ransomware response plans for holiday and event periods?
A: Yes. Plans that assume full staffing and normal approval speed often fail during predictable low-coverage windows. Organisations should pre-assign authority, test reduced-staff scenarios and make sure privileged identity actions can still happen quickly. The response plan has to reflect when disruption is most likely, not just when it is most convenient.
👉 Read our full editorial: Ransomware risk spikes on holidays and material events