The holiday season can be filled with gratitude, joy, and celebration, but it's also brimming with opportunity for cybercriminals.
Risks affect employees at home and at work — and put SMBs at risk on several fronts. How big a problem is this? According to AARP's 2024 Holiday Threats and Fraud report, 82% of U.S. consumers say they've been targeted by at least one holiday-themed fraud (charity scams, bogus retail deals, phantom delivery notices) in the past year. A breakdown from cybersecurity vendor Norton shows that fraud is fairly evenly spread between online shopping scams, phishing tricks, delivery notification scams, and gift card scams.
Key Takeaways
Keep in mind that consumer research completed in 2025 by Pew Research shows 73% of U.S. adults say they've experienced at least one type of online scam or attack. That number is likely to skyrocket during the holidays since sign-up attacks (fraudulent account creation, credential stuffing, etc.) spiked by 309% relative to baseline periods in Q4 2024, showing how attackers capitalize on high-traffic holiday time.
Because employees often use work devices or shared devices for email and online shopping, a misstep by someone in your company can derail operations during this critical time. Here are 10 holiday cyber threats to keep in mind (and share with your team) this holiday season.
Best online shopping security practices: Stick to secure (HTTPS) sites, avoid storing card info in an app or website, separate personal/work devices, and always type in the URL of an interesting new shop or offer vs. clicking a link or an ad.
Want to learn more about protecting yourself from fake apps, QR codes, and websites? Check out this blog with tips from SonicWALL.
Business and personal travel during holidays increases the risk of a cyber breach. Whenever your team hits the road, either for work or holiday travel, remind them to take these proactive security steps:
7. Avoid public Wi-Fi. Saying it loud for those in the back. DO NOT use public Wi-Fi. Rather, invest in a travel hotspot or leverage your cell phone capabilities. Cyber criminals can easily breach Wi-Fi and sneak onto your phone, laptop, or other mobile device – and straight into your work network.
8. Don't access your network without SASE/VPN. For remote workers who routinely access your business IT environment, invest in either SASE or VPN technology. This private "pipeline" into your corporate network protects against infected devices as well as safeguards data in motion through encryption. Learn more in our blog
9. Lock devices in transit. Sometimes good security hygiene is as simple as locking your devices anytime you step away. That protects someone from accessing the device—simple and easy
10. Beware of juice jacking. Is it a silly name? Yes. Is it a serious threat? Also, yes. Juice jacking describes a cyber attack through a public USB or other mobile device charging station. That's why, while those handy charging stations in airports and hotels can look like the perfect solution to your low battery alert, they often are infected with malware or other malicious software designed to sneak onto your device and steal data or lock it down. What are the best tips for staying secure while traveling with work devices? Use those old-fashioned wall outlets to charge your devices or carry an auxiliary charging block you know is safe.
While it might seem as if seasonal cyber risks are more personal in nature, in today's world of remote work, BYOD, and shared devices, personal threats often lead straight to your organization's company network. So, how can SMBs protect employees (and their IT network) from holiday scams?
Use seasonal reminders to raise awareness with your team, highlighting the right steps to take and reminding them of your process for reporting suspected threats or breaches. As always, positive reinforcement works better than scare tactics and threats. The best way to engage your team is through inclusion—reminding them that they play a critical role in protecting your organization, its data, and your customers.
If your organization hasn't invested in and launched security awareness training, consider this your sign to start. Nothing is as impactful as educating and training your employees to be the best cybersecurity protection you have in place. With human error the leading cause of most cyber breaches, having an engaged, responsible team goes a long way in shoring up your defenses.
Want more tips? Read our blog on 10 security awareness best practices
Critical to the success of your SAT are well-documented policies that address safe browsing, personal or shared device use, and travel and remote work best practices. No employee intends to open the door to a cyber attack, but simple, everyday work tasks can be risky if they don't have guidance from experts.
Working with a managed services provider such as Exigent can also improve your cybersecurity stance for several reasons. Managed services provide proactive patching and maintenance, 24x7 automated monitoring, access to IT experts, and guidance on advanced cybersecurity solutions, such as endpoint protection with SOC monitoring and firewall-as-a-service can greatly improve your security posture.
The holiday season should be about celebrations and business success, not security incidents.
Contact Exigent to keep your business protected year-round.
Learn more tips on using security awareness training to protect your team from our ebook
You may also be interested in these related blogs: