The Most Dangerous 6 Weeks of the Year

"The breach that nearly cost a mid-sized manufacturer $2.3 million didn't involve sophisticated malware or a nation-state actor. It started with a procurement manager approving a vendor invoice on December 22nd. The invoice looked legitimate. The vendor was real. The only problem: the bank routing number had been changed by an attacker who'd been watching email traffic for weeks, waiting for the exact moment when distraction would override verification."

"Security programs are built around predictable patterns. Your tools learn what normal access looks like. Your team develops instincts for what requests feel legitimate. Your processes assume a baseline level of attention from employees. The holiday period disrupts all three simultaneously. Employees aren't thinking about security. They're thinking about travel logistics, gift purchases, family obligations, and closing whatever work needs to close before the calendar flips. Cognitive bandwidth that normally catches suspicious details gets redirected to personal planning."

An attacker observed email traffic and changed a vendor's bank routing number, causing a procurement manager to approve a fraudulent invoice and nearly causing a $2.3 million loss. Holiday periods concentrate distraction, increasing legitimate transaction volume and reducing employee vigilance, which makes fraudulent requests blend into real communications. Security baselines and behavioral detection struggle to distinguish unusual but legitimate holiday actions from compromise. Remote or atypical logins during off-hours complicate access-pattern detection. Finance and procurement rushes magnify risk by accelerating approvals and communications. Attackers exploit predictable human and operational patterns during year-end holidays to evade verification.

Read at Securitymagazine