January 25, 2026
New Year's Resolutions for Cybercriminals (Spoiler: Your Business Is on Their List)
Somewhere right now, a cybercriminal is setting New Year's resolutions too.
They’re not staring at a vision board about “self-care” or “work-life balance.”
They’re reviewing what worked in 2025 and planning how to steal more in 2026.
And guess what—small businesses are their favorite target.
Not because you’re careless.
Because you’re busy.
And criminals love busy.
Here’s their 2026 game plan—and how to ruin it.
Resolution #1: "I Will Send Phishing Emails That Don't Look Fake Anymore"
The era of laughably bad scam emails is over.
AI now writes messages that:
- Sound completely normal
- Use your company’s language
- Reference real vendors you actually work with
- Skip the obvious red flags
They don’t need typos to trick you anymore.
They need timing.
And January is perfect timing. Everyone’s distracted, moving fast, and catching up after the holidays.
Here’s what a modern phishing email looks like:
“Hi [your actual name], I tried to send the updated invoice, but the file bounced back. Can you confirm this is still the right email for accounting? Here’s the new version—let me know if you have questions. Thanks, [name of your actual vendor]”
No Nigerian prince.
No urgent wire transfer.
Just a normal-sounding request from someone you recognize.
Your counter-move:
- Train your team to verify, not just read. Any request involving money or credentials gets confirmed through a separate channel.
- Use automatic email filtering that catches impersonation attempts—tools that flag when an email claims to be from your accountant but actually came from a server in Eastern Europe.
- Create a culture where questioning is praised, not punished. “I verified before responding” should be celebrated, not seen as paranoid.
Resolution #2: "I Will Impersonate Your Vendors… or Your Boss"
This one is brutal because it feels so real.
A vendor email arrives:
“Hey, we updated our bank details. Please use this new account for future payments.”
Or a text from “the CEO” hits your bookkeeper:
“Urgent. Wire this now. I’m in a meeting and can’t talk.”
Sometimes it’s not even text anymore.
Deepfake voice scams are rising fast. Criminals clone voices from YouTube videos, podcast appearances—even voicemail greetings. The “CEO” calls your finance person asking for a “quick favor,” and it sounds exactly like them.
That’s not sci-fi.
That’s Tuesday.
Your counter-move:
- Establish a simple callback policy for any bank account changes. Always verify through a known number—not one provided in the email.
- No payment changes without voice confirmation through established channels.
- MFA on every finance and admin account. Even if they steal the password, they still can’t get in.
Resolution #3: "I Will Target Small Businesses Harder Than Ever"
For years, cybercriminals focused on big targets—banks, hospitals, Fortune 500 companies.
But enterprise security improved. Insurance requirements tightened. Big companies became hard and annoying to attack.
So smart criminals pivoted.
Instead of one risky $5 million attack, why not a hundred $50,000 attacks that are far easier and far more reliable?
Small businesses are now the primary target.
You have money worth stealing.
You have data worth ransoming.
And you probably don’t have a dedicated security team.
Attackers know:
- You’re understaffed
- You don’t have a security team
- You’re juggling everything
- You assume “we’re too small to be worth it”
That belief is their favorite vulnerability.
Your counter-move:
- Stop being low-hanging fruit. Basic security—MFA, regular updates, tested backups—already makes you harder to attack than the business next door. Most attackers will move on.
- Remove “we’re too small to be a target” from your vocabulary. You’re not too small to be targeted—just too small to make the news.
- Get professional help. You don’t need an enterprise security team; you need a partner watching your back.
Resolution #4: "I Will Exploit New Employee Season and Tax Chaos"
January brings new hires.
And new hires don’t know your rules yet.
They’re eager to help.
They want to impress.
They’re less likely to question authority.
From an attacker’s perspective? Perfect targets.
“Hey, I’m the CEO. Can you handle this quickly? I’m traveling and can’t do it myself.”
A veteran employee might pause.
A new hire trying to prove themselves? They’re already on it.
Tax season scams ramp up soon too—W-2 requests, payroll phishing, fake IRS notices.
The attack is simple: Someone impersonates your CEO or HR director and sends an “urgent” request to payroll.
“I need copies of all employee W-2s for a meeting with the accountant. Send ASAP.”
Once they have those W-2s, every employee’s Social Security number, address, and salary is compromised. Criminals file fraudulent tax returns before your employees do. Your people find out when their legitimate returns get rejected as “duplicates.”
Your counter-move:
- Security training during onboarding. Before new hires get email access, they should know what modern scams look like—and that nobody will ever ask them to urgently buy gift cards.
- Create explicit policies: “We never send W-2s via email.” “Any payment request gets verified by phone.” Write them down. Train on them. Test them.
- Reward verification. The employee who double-checks a legitimate request should be praised, not made to feel paranoid.
Preventable Beats Recoverable. Every Time.
You have two choices with cybersecurity:
Option A: React after the attack. Pay the ransom. Hire emergency help. Notify customers. Rebuild systems. Repair your reputation.
Cost: Tens or hundreds of thousands of dollars
Timeline: Weeks to months
Outcome: You might survive—but you’ll never forget it.
Option B: Prevent the attack. Implement proper security. Train your team. Monitor for threats. Close vulnerabilities before they’re exploited.
Cost: A fraction of Option A
Timeline: Ongoing, in the background
Outcome: Nothing happens—which is the whole point.
You don’t buy a fire extinguisher after the building burns.
You buy it because you hope you’ll never need it.
How to Ruin Their Year
A good IT partner keeps you off the “easy target” list by:
- Monitoring your systems 24/7, catching threats before they become breaches
- Tightening access and credentials so one stolen password doesn’t unlock everything
- Training your team on modern scams—not the obvious ones, the convincing ones
- Setting verification policies so wire fraud requires more than a believable email
- Maintaining and testing backups so ransomware is an inconvenience, not an extinction event
- Patching before criminals exploit vulnerabilities—closing doors before anyone tries them
Fire prevention, not firefighting.
Criminals are setting their 2026 goals right now. They’re optimistic about the year ahead. They’re counting on businesses like yours to be unprepared, understaffed, and unprotected.
Let’s disappoint them.
Take Your Business Off Their Target List
Book a New Year Security Reality Check.
We’ll show you where you’re exposed, what matters most, and how to stop being low-hanging fruit in 2026.
No scare tactics.
No jargon.
Just a clear picture of where you stand—and what to do about it.
Book your 15-minute New Year Security Reality Check here
Because the best New Year’s resolution is making sure you’re not on someone else’s list of goals to achieve.
