Holiday Season Cyber Security and How to Stay Safe This December

The holiday season brings opportunity and risk for Australian businesses. Whether you a sole trader or a team of 300, December often means increased activity, customer engagement, and unfortunately, cyber threats. Cyber criminals know that businesses are busy, staff may be distracted or on leave, and IT resources stretched. This makes the holidays a prime time for attacks such as phishing, ransomware, and data breaches.

Why are small businesses vulnerable?

According to the ASD Cyber Threat Report 2024-25, the average cost of a cyber incident for a small business is $56,600, not to mention the reputational damage and loss of customer trust.

• Limited resources: Smaller businesses may lack dedicated IT staff or robust security.
• Valuable data: Customer data, financial information, and sensitive health records is attractive to attackers.
• Sophisticated attackers: Modern cybercrime is run by organised, multinational syndicates targeting businesses of all sizes.

Holiday-Specific Risks

• Staff working remotely or on flexible schedules
• Increased use of cloud services and mobile devices
• Temporary staff or contractors with varying security awareness
• Delayed response times due to reduced staffing

Why December Is High-Risk

• Seasonal surge in scams: Cybercriminals know businesses are busy and staff are distracted. Fake invoices, refund scams, and phishing emails disguised as shipping updates are common.
• Year-end financial activity: Attackers exploit payment cycles and invoice processing to launch Business Email Compromise (BEC) scams.
• Reduced staffing: Many businesses operate with skeleton crews or close entirely, leaving systems unmonitored.

Top Cyber Threats This Holiday Season

Understanding the most common cyber threats is the first step to protecting your business, your customers, and your staff. The latest ASD Cyber Threat Report highlights some of these risks.

1. Business Email Compromise (BEC)

BEC scams are Australia’s most expensive cybercrime. Attackers impersonate suppliers or staff to request urgent payments or gift card purchases. Small to medium-sized businesses, are particularly vulnerable due to limited verification processes.

Tip: Always verify payment requests, especially those received in email, by phone or in person. Independent verification is essential to confirm legitimacy. Do not rely on the contact details provided in the payment request. Instead, use contact details obtained from a trusted source and not those provided in the email.

2. Ransomware

The Australian Signals Directorate (ASD) Cyber Threat Report 2024-25 identifies ransomware as one of the most disruptive cyber threats for Australian businesses. Ransomware attacks and data breaches increased in frequency over the past year, with cybercriminals using stolen credentials and malware to compromise networks and extort victims. These attacks often result in significant financial loss, operational downtime, and reputational damage.

ASD notes that ransomware campaigns frequently exploit unpatched systems and weak security practices. Businesses of all sizes remain attractive targets due to the value of their data and the potential for payment under pressure.

Tip: Maintain regular, secure backups and test your recovery process to ensure data can be restored quickly in the event of an attack.

3. Supply Chain Attacks

Supply chain attacks occur when cybercriminals exploit vulnerabilities in third-party vendors or service providers to gain access to your systems. These attacks can be difficult to detect because they often originate from trusted partners.

Key Considerations for Vendor Security:

• Security Standards – Vendors may follow recognised frameworks such as the Australian Cyber Security Centre’s Essential Eight.
• Access Controls – Vendors typically have varying levels of access to client systems, which can influence risk exposure.
• Data Handling Practices – Different vendors use different methods to store, transmit, and protect sensitive data.
• Incident Response Capability – Vendors often maintain documented processes for responding to security breaches.
• Regular Audits – Many vendors undergo periodic security assessments or provide evidence of independent audits.

Independent Verification

Information provided by the vendor may not always be sufficient on its own. Independent sources, such as certification bodies or third-party audit reports can confirm security practices. Contact details included in suspicious communications should not be relied on. Verifying contact information from official records or previously established channels is considered more trustworthy.

4. Phishing and Social Engineering

Phishing remains one of the most common entry points for cyber attacks. During peak period such as holidays, attackers often send emails disguised as special offers, shipping notifications, or urgent requests. These messages are designed to trick recipients into revealing sensitive information or clicking malicious links. The Australian Signals Directorate (ASD) notes that these attacks frequently bypass technical controls by exploiting human behaviour, which makes staff awareness and training an important factor in reducing risk.

Tip: Train your staff to spot suspicious emails and never click on unknown links. Cyber safety programs such as the Australian Government’s Cyber Wardens program, promotes a simple rule “Keep Calm and don’t click” Pausing before interacting with links or attachments helps reduce the risk of phishing and social engineering attacks.

Example Scenario:

A business is preparing to close for the holidays. A staff member, rushing to finish their work, receives an email that appears to be from a trusted supplier, requesting urgent payment for an outstanding invoice. Without verifying, the payment is processed.

The team goes on leave for a week and the issue remains un-noticed. Days later, it becomes clear the supplier never sent the request and the funds are gone, the business faces a financial loss.

This scenario is all too common during the holiday season when staff are under time pressures. It highlights the importance of independent verification, awareness, and strong internal controls to prevent fraudulent transactions.

Know Your Obligations

Australian businesses are subject to the Privacy Act 1988 and the Notifiable Data Breaches Scheme, which set requirements for handling personal information and reporting certain data breaches. Non-compliance can lead to significant financial penalties and reputational damage. A Technology Solutions and Solutions Providers (TSSPs) offer services that align with these regulatory requirements, including system configuration, data protection measures, and monitoring processes. These services are designed to help businesses meet legal obligations and maintain compliance with Australian privacy laws.

Practical Steps to Secure Your Business

• Review and Update Security Policies: Before the holiday rush, review your cyber security policies. Ensure all staff are aware of their responsibilities, especially regarding remote work, device usage, and reporting suspicious activity.
• Patch and Update All Systems: Cyber criminals exploit outdated software. Schedule updates for operating systems, applications, and security tools before the holidays begin.
• Strengthen Authentication: Implement strong password policies and enable multi-factor authentication (MFA) on all accounts, especially those with access to sensitive data.
• Backup Critical Data: Follow the 3-2-1 backup rule: keep three copies of your data, on two different media, with one copy offsite. Test your backups to ensure they can be restored quickly in case of an incident.
• Educate Your Team: Run a quick refresher on how to spot phishing emails, suspicious links, and social engineering tactics. Remind staff to be cautious with unfamiliar attachments or requests for sensitive information.
• Limit Access: Review user permissions and restrict admin privileges to only those who need them. Remove access for temporary staff or contractors who no longer require it.
• Prepare an Incident Response Plan: Ensure everyone knows what to do if a breach is suspected. Have clear steps for reporting, containing, and recovering from incidents.

What is the Essential Eight?

The Essential Eight is a set of baseline cyber security strategies recommended by the Australian Cyber Security Centre (ACSC) to help businesses protect against cyber threats.

Here’s a quick overview of the eight strategies and why they matter.

Working with a TSSP can help you implement these controls efficiently, ensuring your business is protected against the most common and damaging cyber threats.

Working with a Technology Services and Security Provider (TSSP)

Cyber security can feel overwhelming especially for busy business owners and sole traders who are focused on delivering services, not managing IT systems. Navigating the complexities of commercial level cyber security can be overwhelming. A technology services and solutions provider (TSSP) offers the expertise needed to assist business owners manage their cyber security needs effectively.

By partnering with a technology services and security provider, businesses can leverage advanced security measures without the need for an in-house team. This ensures that the business’s digital assets are well-protected and compliant, allowing the business to focus on what’s important.

That’s where a Technology Solutions and Services Provider (TSSP) comes in. A TSSP provides expert guidance, tools, and ongoing support to help businesses implement and maintain robust cybersecurity measures, including the Essential Eight strategies recommended by the Australian Cyber Security Centre.

Key Benefits of Partnering with Harvey Norman Technology for Business

• Proactive Monitoring: Continuous 24/7 threat detection with rapid incident response.
• Automated Backup Management: Secure, scheduled backups with fast recovery options to minimise downtime.
• Security Training: Ongoing education for you and your staff, including phishing simulations.
• Compliance Support: Guidance on meeting legal and industry requirements, such as the Australian Privacy Act and Notifiable Data Breaches Scheme.
• Affordable Solutions: Enterprise-grade security designed to suit small and medium business budgets.
• Stress-Free IT: Updates, patches, and troubleshooting, reducing your workload and risk.

Why Choose Harvey Norman Technology for Business

• Simplified IT | Enterprise-grade solutions, secure networks, and expert technology services made easy and stress-free
• Proactive Protection | 24/7 monitoring, real-time threat detection, compliance-ready security, and preventative system maintenance.
• Cyber security | Secure backups, recovery management, advanced threat protection, and rapid incident response.
• Local Expertise, Nationwide Support | Access to a world-class help desk, backed by personalised service and the support of a trusted national brand.

Holiday Cyber Security Checklist

• All devices and software updated and patched
• Strong passphrases and MFA enabled
• Critical data backed up, recovery tested and documented
• Staff briefed on cyber threats and reporting procedures
• Access rights reviewed and updated
• Incident response plan in place and communicated

Final Tips for a Secure Holiday Season

• Schedule a pre-holiday security review with your TSSP.
• Set up alerts for unusual account activity or login attempts.
• Ensure someone is available to respond to incidents, even during office closures.
• Remind staff to be extra vigilant with emails and links, especially those related to holiday sales or urgent requests.
• Review your suppliers’ security practices to reduce supply chain risk.

The holidays should be a time of celebration, not crisis. By taking proactive steps and partnering with a trusted Technology Services and Security Provider like Harvey Norman Technology for Business, SMEs and sole traders can enjoy peace of mind and keep their businesses safe from cyber threats.

Want peace of mind this holiday season?

Contact us to learn how learn how we can help you stay secure.