Why Attackers Wait for Long Weekends and Why It Matters More at a Fund

Sep 5

4 min read

Labor Day is Monday, September 7. Behind it is the September every fund knows by heart: quarter end, LP letters, audit preparation, and the fall fundraising calendar arriving together.

Your desk will thin out this week, and it should. Today's post isn't a list of things to handle before it does. It's an explanation of why attackers care about this particular weekend, and an account of what's running on your behalf while nobody's at the terminal.

BREAKING IN AND SETTING IT OFF AREN'T THE SAME DAY

Ransomware isn't a single moment. Someone gets in discreetly, often weeks ahead, and then works patiently. They map the network, locate the backup system, and identify which accounts reach the furthest. To a system nobody is reviewing, most of that looks like routine administration.

The encryption comes last, and it's a scheduling decision. They trigger it when they expect the slowest response. A long weekend isn't a technical opening. It's a staffing opening.

THE NUMBERS AND THE ONE THAT SHOULD INTEREST YOU MOST

Semperis surveyed about 1,500 IT and security professionals across ten countries and published the results in late 2025. Fifty-two percent of the organizations that were attacked said it landed on a weekend or holiday, rising to fifty-six percent in the United States. Seventy-eight percent cut security staffing by half or more during those windows, and six percent had no coverage at all outside business hours.

One finding matters more to a fund than to almost anyone else. Sixty percent of attacks followed a material corporate event, and of those, more than half followed a merger or an acquisition.

Now read that against the ordinary year at an alternative investment manager. A fund launch. A new share class. A seed investor coming aboard. A GP stake sale. A portfolio company closing. A senior departure that reshuffles who's authorized to sign. A firm running two of those at once, in the week before a holiday, is sitting in precisely the conditions that study describes. Most funds live in a near permanent material event.

There's a regulatory edge to it as well. Operational resiliency sits squarely in the SEC Division of Examinations priorities for fiscal 2026, and the amended Regulation S-P notification requirements are now in force. An incident that runs sixty hours before anyone assesses scope stops being an IT matter. It becomes an exam finding, an LP disclosure, and an uncomfortable line in the next due diligence questionnaire.

The practical point is narrower than it sounds. No adviser is examined on whether it was attacked. It's examined on how quickly it knew, what it did next, and whether it can show its work. All three come down to who was watching on Sunday

WHAT'S RUNNING THIS WEEKEND

None of that describes your firm, and here's specifically why.

We watch your systems straight through the holiday, including overnight. Alerts reach a named person, not a queue that opens Tuesday.
We keep your backups somewhere a stolen password can't reach them, and we test that we can restore from them.
We hold a current escalation list for your firm, and we checked those numbers before the holiday rather than during it.
We enforce multi-factor authentication and conditional access, so a stolen password on its own doesn't open anything, and we keep administrative privileges limited to the accounts that genuinely need them.

If a machine gets infected or an account is compromised, we take it off the network ourselves, immediately, without waiting for anyone's approval. That's why we've never asked you to nominate someone to be reachable at three in the morning. That was never your job.

And we don't depend on the office. Recovery procedures are documented and tested from outside the building, because a plan that requires somebody to reach midtown on a Sunday isn't really a plan.

AT TWO IN THE MORNING, THE QUESTION IS WHO PICKS UP?

Sixty-nine percent of managed service provider acquisitions now involve private equity buyers. That consolidation shows up in exactly one place, and it isn't the software. Both a platform and an independent firm deploy comparable tooling.

It shows up in who receives the alert. On a consolidated platform, your incident joins a ticket queue alongside every other client acquired across every rolled-up regional firm. The engineer who answers may never have seen your environment. The escalation path ends with a manager who's accountable for a response-time metric rather than for your fund.

Roark has been independently owned since 1998, with no outside investors and no debt. We're boutique in structure and considerable in reach, supporting clients in 21 metropolitan areas across 7 countries and 4 continents, spanning 17 time zones from Tokyo to San Francisco, through centralized operations and vetted local partner firms we select and manage ourselves.

When something happens on the Sunday of Labor Day weekend, you're not filing a ticket. You're talking to people who know your environment, and to an owner who still answers the phone.

THE ONE THING NO PROVIDER CAN DO FOR YOU

Wire fraud is a timing problem before it's a technical one. An instruction arrives Saturday with a familiar signature and a deadline attached, and the person who'd normally question it is unreachable. We can flag a suspicious message. We can't make the phone call.

So one sentence to your team before Thursday is worth saying out loud: no payment instruction moves over the holiday without a voice call to a number they already have. Never a number printed in the email itself.

That's the whole ask. Everything else is ours.

Enjoy the long weekend. Making that possible is rather the point of the arrangement.

If a colleague or peer at another firm would find today's post useful, please pass it along.

Since 1998, Roark Tech Services has been the IT partner of choice for alternative investment firms that expect expertise, accountability, and an owner who still answers the phone. We do not do standardized. We do not do anonymous. We do bespoke, and we have since before most of our competitors existed.

Contact us.