Do holidays and weekends still define ransomware timing?

TL;DR: Semperis' analysis of ransomware timing finds attacks cluster around holidays, weekends and major corporate events, with 52% of organisations targeted on those dates and 60% hit after mergers, acquisitions, IPOs or layoffs. Response plans need named authority and tested recovery when staffing is thin and ownership is unclear.

Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “NEW Semperis Study Reveals that the Majority of Ransomware Attacks Continue to Occur During Holidays and Weekends”.

By the numbers:

• 52% of surveyed organisations were targeted on holidays or weekends, according to Semperis research.
• 78% of companies cut SOC staffing by 50% or more during holidays and weekends, according to Semperis research.
• 6% cut their SOC staffing entirely during holidays and weekends, according to Semperis research.

Key questions

Q: Why do mergers, acquisitions, and layoffs increase ransomware risk?

A: These events create ownership confusion, delayed access cleanup, and temporary permissions that outlive their purpose.

Q: How can organisations tell whether ITDR is actually helping against ransomware?

A: Look for whether identity detections are followed by enforced containment, named ownership and recovery completion.

Q: What breaks when SOC staffing drops during holidays and weekends?

A: Detection still works on paper, but response slows because the people who can validate alerts, revoke access and coordinate recovery are not fully available.

Practitioner guidance

• Define off-hours containment ownership Assign named decision-makers for account disablement, privileged session termination and recovery approval during holidays and weekends, with clear delegation if the primary owner is unavailable.
• Pre-stage event-driven governance playbooks Create separate response runbooks for mergers, acquisitions, IPOs and layoff periods so access changes, escalation paths and exception approvals do not depend on informal coordination.
• Test identity response under reduced staffing Run exercises that simulate holiday coverage, including delayed triage, delayed approval and limited recovery staff, to see whether ransomware containment still works under realistic pressure.

Bottom line: Ransomware operators benefit when defenders are least available to validate, revoke and recover, which turns holidays, weekends and corporate transitions into predictable risk windows.

Glossary terms: Coverage gap resilience, Material event risk window, Identity Threat Detection and Response, Standing Privilege

What's in the full report

Semperis' full report covers the operational detail this post intentionally leaves for the source:

• Breakdowns of holiday and weekend ransomware targeting by country and vertical, useful for benchmarking your own exposure
• The underlying survey responses behind SOC staffing cuts, including why organisations reduce coverage during low-activity periods
• The ITDR findings on detection, remediation and recovery maturity, which help teams compare response depth against peers
• The report's wider identity resilience framing for hybrid identity environments, including Active Directory and Entra ID context

👉 Read Semperis' 2025 ransomware holiday risk report →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →