Attackers keep office hours. They just aren't yours.

At the end of August, Manchester Airports Group, which runs Manchester, London Stansted and East Midlands airports, disclosed that criminal hackers had accessed the data of about 8.7 million customers. Email addresses, phone numbers, vehicle registrations and postcodes linked to car park, lounge and fast-track bookings and airport wifi sign-ups were taken. The data was obtained at the weekend, and the company says it only became aware of the hack on the Tuesday, when it moved quickly to contain it.

MAG told The Register that this was an extortion attack, not ransomware: one of its systems was compromised and files were taken from a database hosted by a third party. Flights kept flying and payment details were not involved, as The Guardian reported. It happened in peak summer travel season.

The lesson is not about one airport operator. It is about timing. Attackers keep office hours, and they are rarely yours.

Why out-of-hours matters

Weekends, nights and holidays are when fewer people are watching, approvals are slower and an unusual login is more likely to sit in a queue until someone gets to it. Every hour between the first sign of trouble and a decision to act is time an intruder can use to move, collect data or prepare the next step. The question is simple: if something started at 2am on a Saturday, who would notice, and who would be allowed to do something about it?

What good 24/7 monitoring looks like

Coverage. Monitoring is only as good as what it can see. That means identity and sign-in activity, endpoints, email, cloud platforms, internet-facing systems and the third-party services that hold your data. Blind spots tend to be exactly where incidents begin.

Detection engineering. Alerts should reflect how your organisation actually works and the threats it actually faces, and they should be tuned over time. A flood of generic alerts is not monitoring; it is noise that hides the alert that matters.

Escalation and on-call. Someone must be reachable at any hour, with a clear route from analyst to decision-maker. Contact lists, deputies and thresholds for waking people up should be written down and tested, not assumed.

Response authority. Spotting an attack is half the job. Agree in advance what the monitoring team may do without asking: disable an account, isolate a laptop, block an address. Containment rights decided at 3am under pressure are rarely decided well.

MDR, in-house or hybrid. A managed detection and response (MDR) provider or outsourced SOC can give round-the-clock coverage that is hard to staff internally. An in-house team knows your business best. Many organisations combine the two. The right answer depends on your risk, your size and what you can realistically sustain.

Measuring a provider. Ask how they measure mean time to detect (MTTD) and mean time to respond (MTTR), what they report to you and how often, which containment actions they are permitted to take, and what happens when they cannot reach you.

If something started at 2am on a Saturday, who would notice?

A quick self-check

• Who receives a high-severity alert at 2am on a Sunday, and how quickly do they see it?
• Can that person, or your provider, disable an account or isolate a device without waiting for approval?
• Do you know which of your suppliers hold your data, and would you hear from them if they were breached?
• When did you last test your escalation route out of hours?
• Does your monitoring cover cloud and identity, or mainly on-premises systems?

If any of those answers begins with "I'm not sure", that is worth knowing now rather than on a bank holiday weekend.

How Amon Dîn helps

Amon Dîn provides independent 24/7 monitoring and SOC advisory. We help organisations design round-the-clock monitoring that fits their risk, decide whether to build, buy or combine, and source or assess an MDR or SOC provider. We help set detection priorities, escalation routes and response authority, oversee the provider once it is in place, and run tabletop exercises so the first out-of-hours incident is not the first time the plan is used.

← All Signals