New Semperis Ransomware Risk Report reveals common patterns that cybercriminals exploit

Cybercriminals have long been known to strike when defences are down, but new findings from cybersecurity company, Semperis’ 2025 Holiday Ransomware Risk Report suggest that activity can be predicted. The global study, which examined attack patterns across Singapore, the U.S., Canada, Europe, the UK, Australia, and New Zealand, reveals that ransomware operators most often time their attacks to coincide with holidays and weekends, as well as major corporate events such as mergers, acquisitions, and layoffs.

One of the report’s earliest observations is the steady rise in attacks during holiday periods, when security staffing is reduced. Globally, 52% of ransomware incidents happen during holidays. Singapore stands out even more starkly, with 59% of attacks striking local organisations during these periods.

This vulnerability stems largely from changes in local trends in company closures. A significant 78% of companies reduce their security operations centre (SOC) manpower by half or more on holidays and weekends, and 6% cut SOC coverage entirely. The intention behind these decisions is understandable: two in three organisations in Singapore do so to support employee work-life balance, and nearly half close entirely on public holidays, granting staff time off. For 30% of organisations, this decision is partially driven by organisations simply not believing threats will occur during these times. But the high proportion of attacks is a clear indication that cybercriminals are watching, and exploiting these assumptions.

Yet even these rest-related vulnerabilities pale in comparison to the risks posed by corporate material events. Semperis’ report shows that in Singapore, eight in ten ransomware attacks occur following major organisational changes, with mergers and acquisitions (M&A) representing the most common trigger. Layoffs and restructurings rank second. As teams grapple with shifting governance structures, merged identity systems, and operational uncertainty, attackers find ideal conditions to plant or activate ransomware.

“Corporate material events such as mergers and acquisitions often create distractions and ambiguity in governance and accountability — exactly the environment ransomware groups thrive on,” said Chris Inglis, Former US National Cyber Director and Semperis Strategic Advisor. “Worse, organizations are under intense pressure to sustain operations while transforming their form and protocols during an IPO or merger and cannot afford downtime, making them more likely to pay quickly to restore operations.”

Rather than discouraging well-deserved time off or delaying important corporate milestones, Semperis recommends that organisations plan intentionally around these predictable high-risk periods. Third-party monitoring services, coordinated cross-team communication, and robust identity system protections are among the key practices highlighted.

In an increasingly hostile cyber environment, companies cannot afford complacency. At the same time, overburdening teams is not the answer. This would only create new vulnerabilities. The path forward lies in thoughtful preparation and continuous vigilance, especially during moments when the business is busiest, or formally on break.