Ian Robertson
August isn’t a holiday for attackers
Staff in Victoria and across the Capital Regional District are easing back from beaches and barbecues. Cybercriminals are not. Late summer is one of the busiest times for phishing, with lures that match what people are doing right now, like booking travel, getting kids ready for school, and catching up on email after time away. Security vendors continue to flag back‑to‑school and travel‑themed scams that look and feel legitimate. For example, Proofpoint has highlighted sophisticated back‑to‑school lures targeting students and staff.
These emails are often AI‑assisted, so they are free of the old tell‑tale mistakes. Logos look right, grammar is clean, and details can be personalised. One distracted click can still lead to credential theft, malware, or a business email compromise that impacts invoices and payables.
Why Victoria SMBs are at higher risk in late summer
Smaller teams in Victoria, Saanich, and Esquimalt often wear many hats, so cyber security can slide during holidays. The return‑to‑work rush also creates the perfect conditions for mistakes. People are triaging inboxes, signing into systems from travel laptops, and mixing personal and work accounts. Attackers know this rhythm and time their messages to match it.
Common August lures to watch for
-
Vacation booking lookalikes - fake hotel, airline, or home‑rental confirmations that request an urgent account check.
-
Back‑to‑school messages - bookstore or university impersonations that ask for logins or payment.
-
Password reset prompts - notices tied to so‑called unusual sign‑ins that send you to a fake portal.
-
Delivery notices - “you missed a package” texts that link to credential harvesters.
-
Public Wi‑Fi traps - captive portals that intercept logins on unsecured networks.
Practical steps to shore up security this month
Refresh training after time off
Schedule a short refresher in the first week back. Remind staff to hover over links, check sender domains, and slow down when an email feels urgent. Reinforce that no one will be disciplined for reporting a false alarm. Silence is the bigger risk.
Keep work and personal accounts separate
Encourage staff to avoid personal email on work devices. The crossover risk is real. A single malicious attachment opened in the office can spread quickly. If personal access is unavoidable, use a separate browser profile to reduce spillover.
Use endpoint security that can think for you
Ask your managed service provider about EDR, which stands for Endpoint Detection and Response. EDR watches for suspicious behaviour, such as unusual logins, odd processes, or known bad domains, and can isolate a device before problems spread.
Switch to stronger MFA
If someone does steal a password, multifactor authentication shuts the door. Prefer app‑based MFA or a physical security key over text messages. SIM swap fraud and number porting make SMS less reliable.
Travel smart on Wi‑Fi
If work must happen on the road, use a VPN to keep traffic encrypted. Better yet, tether to a trusted mobile hotspot instead of unknown public Wi‑Fi. Avoid signing into finance and HR systems on shared networks.
Add real‑time monitoring
Real‑time email and web filtering can block many phishing attempts before they ever reach an inbox. Ask for alerting that distinguishes between noise and high‑risk activity so your team knows when to act fast.
A 30‑day checklist for Victoria teams
-
Run a 20‑minute refresher on phishing, with local examples and recent lures.
-
Test MFA everywhere, including email, remote access, and finance tools, and move away from SMS.
-
Confirm EDR is deployed on every workstation and server, including travel laptops.
-
Review email rules and forwarding to catch signs of account compromise.
-
Separate browser profiles for work and personal use on company devices.
-
Require VPN for remote work and verify the configuration is current.
-
Revisit your incident response steps, including who to contact, how to isolate a device, and what to document.
What “good” looks like by September
-
Staff report suspicious messages quickly, even if they are unsure.
-
Every critical system has MFA enforced, with app‑based or key‑based methods.
-
EDR is active and centrally monitored, with the ability to quarantine devices.
-
Email filtering, DNS protection, and web controls are tuned for current threats.
-
Leadership receives a short monthly security report that is clear, non‑technical, and actionable.
Want a quick outside view?
Robertson Technology Group can provide a practical check‑in on your environment, including what is working, what needs attention, and how to reduce risk without slowing the team down.
👉 Book a 15‑minute intro call: https://www.rtgroup.ca/15minutes
About Robertson Technology Group
Robertson Technology Group provides managed technology, security, and support for small and medium businesses in Victoria, the CRD, and across Canada. As a local partner, RTG pairs best‑fit tools with practical guidance - EDR, MFA, VPN, secure AI practices, and clear training - so teams stay productive. Services include proactive monitoring, incident response planning, vendor coordination, and friendly support that speaks plain language. RTG evaluates new products often and recommends what fits each environment, not just the latest trend. Pricing is customised to the organisation and scales with growth. For seasonal risk windows like late summer, RTG helps leaders focus on the essentials - phishing awareness, safer authentication, and real‑time protection - while keeping day‑to‑day operations running smoothly.
