52% of Ransomware Attacks Land on Weekends and Holidays, International Report Shows

Holiday Blind Spots: Over Half of Ransomware Hits When Staff Are Away

More than half of organizations hit by ransomware report that the attack began on a weekend or a public holiday, according to the Ransomware Holiday Risk Report 2025. At the same time, 78% of companies reduce security operations centre staff by at least 50% during these periods—and 6% have no dedicated personnel monitoring alerts at all, the study shows. The gap creates a predictable window that attackers actively exploit.

Romanian hosting and cybersecurity provider cyber_Folks issued the warning as summer holidays thin out IT teams across the country. “Attackers don’t respect a company’s leave calendar,” said CTO Horațiu Șimon. “An incident that might be spotted and stopped quickly on a normal working day can remain undetected much longer when responsibilities are not clearly handed over, alerts go unwatched, or there is no permanent monitoring.”

Automated scanning tools do not discriminate by company size, the report stresses. An unpatched website plugin, a compromised password or a misconfigured service can invite a ransomware payload without any human attacker ever learning the firm’s name. Between 1 June and 1 August 2026 alone, cyber_Folks patched over ten critical server-level vulnerabilities to keep client sites running safely.

Artificial intelligence adds pressure. Research published this year has shown that advanced AI models can identify vulnerabilities and generate working exploits within hours in controlled test environments. Meanwhile, phishing emails in Romanian are now written without the grammatical errors that once helped users spot fraud, and they often include the recipient’s name, company project details and partner names—making them far more convincing.

Inside the Attack Window: Staffing Gaps, Automation and the AI Accelerant

The Exploitation of Staffing Gaps

The data point is straightforward: 52% of ransomware events begin when live monitoring is at its weakest. The mechanism is equally clear—fewer eyes on alerts means longer dwell time. “The problem is not the holiday itself,” said Șimon, “but the lack of a system that works even when key people are absent.” An email account compromised because two-factor authentication was never switched on can then be used to send fake payment requests to colleagues or to change bank details on invoices, all while the legitimate user is away.

Why No Business Is Too Small

Automated attack chains scan the internet continuously for unpatched WordPress plugins, exposed remote-desktop ports or stolen credentials sold on dark-web marketplaces. “Many entrepreneurs think their business is too small to be of interest,” said Șimon. “In reality, an automated attack doesn’t distinguish between a corporation and an online shop run by a team of a few people.” Once a vulnerability is detected, malware can be installed, data copied or access locked within minutes.

AI as an Accelerant for Attackers

2026 research has demonstrated that large language models can slash the time from vulnerability discovery to functional exploit. The same tools generate phishing lures tailored to a specific company’s projects and partners, in near-perfect local language. Without two-factor authentication, a single compromised email account can open the door to conversations, documents, contacts and cloud applications—quickly escalating a small foothold into a full business crisis.

Regulatory Exposure Under NIS2

For companies that fall under the European NIS2 directive, failure to manage cybersecurity risks and report incidents can trigger fines of up to €10 million or 2% of annual worldwide turnover. The regulation means that a ransomware event is no longer just an operational headache; it carries direct financial and legal consequences that can escalate rapidly if incident response is delayed because of holiday staffing.

Preparing for the Next Holiday: Practical Steps to Close the Gap

• Verify before leave periods that automated backups are active, complete and can actually be restored. A backup that cannot be recovered is useless during a ransomware lockdown.
• Switch on two-factor authentication for email, hosting accounts and any other critical service. The article notes that a single compromised email, without 2FA, can grant wide access.
• Designate at least one person who can receive and escalate alerts in the absence of the usual owner. Ensure contact details are current and that the person knows the procedure.
• Keep platforms, plugins, operating systems and applications fully updated—automated scanners prey on known vulnerabilities, and WordPress security flaws appear weekly.
• Avoid situations where a single individual holds all passwords or recovery keys. Store access credentials securely and make them available to emergency contacts.
• Test the restoration procedure for websites, servers and databases before the quiet period. The co-CEO of cyber_Folks, Ionuț Ariton, emphasized that “the difference between a managed problem and a major incident is often reaction time.”