Holiday Ransomware Season: Test Your Burnaby Backups

The December stretch is busy for most Burnaby businesses. Staff take time off, the office closes between Christmas and New Year's, and whoever looks after IT is probably on a ski hill. That quiet window is exactly what ransomware crews look for.

This isn't folklore. In 2021 the FBI and CISA published a joint advisory, Ransomware Awareness for Holidays and Weekends, after a run of attacks timed to Mother's Day weekend, Memorial Day weekend and the Fourth of July weekend. Their reasoning was blunt. Holidays give attackers "a head start" because "network defenders and IT support of victim organizations are at limited capacity for an extended time."

So here's the case for doing one boring thing in November: prove your backups actually restore.

What the Canadian numbers say

Statistics Canada's Impact of cybercrime on Canadian businesses, 2023 found that about 1 in 6 (16%) Canadian businesses were impacted by cyber security incidents in 2023. Of those, 13% reported ransomware. Most ransomware victims (88%) didn't pay. Among those who did, 84% paid less than $10,000, while 4% paid more than $500,000. Total recovery spending doubled from roughly $600 million in 2021 to $1.2 billion in 2023, and small and medium firms each accounted for about $300 million of it.

Two things stand out. First, ransomware hits a minority of businesses in any given year, so this is about managing a tail risk, not a certainty. Second, most victims got through without paying, and the thing that lets a business say no is a clean, restorable copy of its data.

The Canadian Centre for Cyber Security's Ransomware Threat Outlook 2025-2027 adds context. It reports a 26% average year-over-year increase in Canadian ransomware incidents from 2021 to 2024, an average it expects to continue through 2025. It also judges that the actors hitting Canadian organizations are "almost certainly opportunistic and financially motivated." Opportunistic is the key word. You don't need to be interesting to get hit. You just need to be reachable.

Where AI fits in, on both sides

The same Outlook says ransomware actors have been using generative AI, particularly large language models, for developing malware, generating deepfakes, automating negotiations with victims, conducting vulnerability research and running social engineering. In plain terms, the fake invoice your bookkeeper gets on December 23 will probably read better than it would have a few years ago.

AI helps defenders too, but in narrower ways than the hype suggests. A well-built AI assistant can read your backup job reports every morning, flag a job that quietly failed, summarize the logs in plain English, and keep nudging the right person until it's fixed. That's genuinely useful, especially over a two-week shutdown. What AI can't do is make an online backup safe from an attacker who already has admin access. Protection comes from how the copies are stored and whether you've proven they restore. Good automation just makes sure the checking happens during the weeks nobody's watching.

What the official guidance actually asks for

The Cyber Centre's Ransomware playbook (ITSM.00.099), in its second release from January 2026, is specific. It says "you should have 2 or more backups stored offline and inaccessible by your networks and internet connection," and it recommends a schedule "to test your backups on a regular basis (for example, monthly)." It also walks through full, differential and incremental backups, and points out that online and cloud backups are convenient but still exposed to attack.

The US #StopRansomware Guide from CISA, MS-ISAC, NSA and the FBI (September 2023) lands in the same place: "Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario." It explains why, too. Many ransomware variants "attempt to find and subsequently delete or encrypt accessible backups." The guide also mentions immutable cloud storage, and suggests considering a second cloud vendor for cloud-to-cloud backups in case every account with one provider is affected.

Notice the shared emphasis. Neither document just says "have backups." Both say have copies an attacker can't reach, and prove they work.

A pre-holiday restore drill you can run in an afternoon

Pick a quiet Tuesday in November, not December 22. Then work through this:

• List what you can't operate without. Accounting file, customer database, shared drive, email, booking system, any line-of-business app. Write down who owns each one.
• Confirm where every copy lives. Is at least one copy offline or immutable? A USB drive that stays plugged into the server all year doesn't count, because ransomware can reach it.
• Restore something real to a separate machine. A green "success" on the backup job isn't a test. Open the restored accounting file. Log into the restored app. Check the date on the newest record.
• Time it. If restoring the shared drive takes 14 hours (an illustrative number), you want to learn that now, not on Boxing Day.
• Check who can get in. Can someone other than your IT person open the backup console? Is that login protected with MFA, and are the credentials stored somewhere that won't get encrypted along with everything else?
• Treat cloud apps separately. Read what your Microsoft 365, Google Workspace or SaaS retention settings actually cover instead of assuming the provider keeps everything forever.
• Write a one-page runbook and print it. Who calls whom, where the offline copy is, which systems come back first. A runbook saved only on the file share is the first thing you'll lose.

Then fix what broke, and put the next test in the calendar. The playbook's monthly suggestion is a sensible default.

Where this doesn't apply

Some honest limits.

If your business runs entirely on a couple of SaaS tools and has no server or shared drive, the drill looks different. Your risk shifts toward account takeover and the provider's retention settings, so the real test becomes "can I recover a deleted folder and lock out a compromised account?"

Backups don't fix data theft. The Outlook notes that groups often steal data before encrypting it so they can run double extortion, and some add DDoS attacks or contact your suppliers and partners. A perfect restore won't stop someone from publishing client files. That's where MFA, patching and tight access control come in, and where you may have privacy obligations worth getting proper advice on.

The statistics have gaps, too. The StatCan figures are self-reported survey results for 2023, and the US holiday advisory describes 2021 attacks on large American targets. They show a pattern, not a forecast for your particular shop.

And AI monitoring of backups isn't worth it for everyone. If you've got one laptop and a cloud drive, a calendar reminder and a monthly manual restore will do the job. Automation earns its keep when you have several systems, several backup jobs, and nobody whose actual job is reading backup reports.

The short version

Attackers like holidays because nobody's watching. Canadian and US guidance agree on the fix: offline or immutable copies, tested regularly. Test now, while there's still time to fix what you find.

Sources

• Statistics Canada. "Impact of cybercrime on Canadian businesses, 2023." The Daily, released October 21, 2024. https://www150.statcan.gc.ca/n1/daily-quotidien/241021/dq241021a-eng.htm
• Canadian Centre for Cyber Security. "Ransomware Threat Outlook 2025-2027." Page modified January 28, 2026. https://cyber.gc.ca/en/guidance/ransomware-threat-outlook-2025-2027
• Canadian Centre for Cyber Security. "Ransomware playbook (ITSM.00.099)." Second release, January 28, 2026. https://www.cyber.gc.ca/en/guidance/ransomware-playbook-itsm00099
• CISA, MS-ISAC, NSA and FBI. "#StopRansomware Guide." September 2023. https://www.cisa.gov/stopransomware/ransomware-guide
• FBI and CISA. "Ransomware Awareness for Holidays and Weekends" (AA21-243A). 2021, last revised February 10, 2022. https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-243a

If you run a business in Burnaby, New Westminster or anywhere in Metro Vancouver and want a second set of eyes on your backup setup, or an AI assistant that checks backup reports so nobody has to remember, book a free call with Autana. We'll tell you straight if a calendar reminder is all you actually need.