Something Went Wrong at Your Philippine Office During the Year-End Shutdown: Break-In, Leak, System Outage or Unreachable Staff

The first hour: triage remotely and decide who, if anyone, must go in

In the first hour after bad news reaches you remotely, there are only three questions: could anyone be hurt, is the loss still growing, and is there anything that becomes irreversible within hours if nobody acts. If all three are no, it can wait until the office reopens. If any one is yes, someone has to interrupt their holiday.

Year-end incidents usually surface through a building guard calling, a neighbour or downstairs tenant messaging, a CCTV or alarm push notification, a customer complaining publicly on social media, or an automated system alert. Whatever the source, do these things first:

1. Verify the message is real. Year-end is peak season for fraud, and a call saying your office has a problem and you need to transfer money to fix it is not unusual. Call back on the building management number you already have saved, not the number that called you.
2. Ask the caller to describe, not to judge. Ask what they can see, not whether it is serious. Whether the door is open or forced, whether water is dripping or pouring, where smoke is coming from: those details decide the next step.
3. Call the professionals who can reach the site fastest. Signs of fire mean the fire service. Signs of forced entry mean asking security to hold the door from outside without entering. A leak means asking the building engineer to shut the valve. All of them are faster and safer than your own staff.
4. Then decide who goes. The rule: two people together, in daylight, with keys and ID, photographing before touching anything. Never send one person alone at night to open a door that may have been forced.
5. Open an incident log. From the first message onward, record in time order who said what, what you decided and when people arrived. You will need this log for the insurer, the police report and your own review.

A common mistake is to treat feeling uneasy as a reason to send someone back. Year-end travel is expensive and the personal safety risk is real. Only a loss that is still spreading, or one that becomes irreversible within hours, justifies pulling someone off their holiday. Everything else gets photographed, locked and dealt with when the office reopens.

Break-in or theft: do not go in first, report first, and get the building to document it

If a lock is broken or things are missing, the correct first reaction is not to enter, not to tidy up, and to report, so that the police and the building record the scene before anyone disturbs it. Many companies lose more at the insurance and recovery stage than in the theft itself, because the first employee on site helpfully cleaned up and nobody could later prove what was taken or that it was taken by force.

Follow this order:

1. Photograph from outside the door. The door, the lock, windows, any damage, all before you or security step in.
2. File a police report and get the reference. Report at the station covering the premises and ask for a copy of the blotter entry or report number. Police are also on holiday rosters and you may wait, but this step cannot be skipped: without a report the insurer will generally not entertain the claim and recovery against anyone is impossible.
3. Get the building's written record. The management incident report, the guard's patrol log, access card and elevator logs, and CCTV from common areas. Submit a written preservation request the same day. Footage is kept for a short time; wait until after the holiday and it may already be overwritten.
4. Count against a list. Do not say from memory that roughly these things are gone. Check item by item against the fixed asset register and stock records and produce a missing-items list, noting where the purchase proof for each item is kept. How count differences interact with your books and tax filings is covered in year-end inventory count does not match.
5. Notify the insurer. Most property policies require notice within a period set out in the policy. Call or email to register the claim first and send documents afterwards; do not wait until the file is complete. If the claim is later refused or cut down, see insurer refuses or reduces a business claim.
6. Check for items that are worthless to a thief but dangerous to you. The company seal, blank cheques, online banking tokens, copies of employee IDs, customer data. Losing these matters far more than losing a laptop. See company chequebook or banking token lost or stolen.

If the signs point to someone inside (no forced entry, only specific items taken, knowledge of where keys or passwords were kept), do not discuss it in group chats and do not confront anyone before the holiday ends. Preserve the evidence and handle it with management and a lawyer when the office reopens.

Water, power and fire hazards: cut the source, notify neighbours, photograph the damage

These incidents share one feature: every hour adds to the loss. They are the category most worth sending someone in for during a holiday, but the first action on arrival is always to cut the source, never to rescue belongings.

Water. The most common holiday incident. A blocked air-conditioning drain, an ageing pipe joint or a problem in the unit above, running for days in an empty office, ruins flooring, documents, electronics and the ceiling of the tenant below. Order of work: have the building engineer shut the unit or floor valve; on arrival photograph the source, the water level and the damaged items; move documents and electronics that are still dry to higher surfaces; notify the affected unit below and leave contact details. If the water came from above, liability usually does not sit with you, but you still have to stop the loss and preserve evidence. Liability and claims are covered in leak from the unit above flooded my place. If the water came from your unit and damaged the floor below, contact them and the building proactively rather than waiting to be found.

Power. Not dangerous in itself but it cascades: refrigerated stock spoils, servers shut down hard once the backup battery is exhausted, access control and CCTV go dark. Ask the building whether the outage is building-wide or only yours. If only yours, it may be a tripped breaker or an unpaid bill; send a qualified electrician, not an ordinary employee, to the panel. If you run servers, confirm remotely whether they shut down cleanly, and schedule a data integrity check if they did not.

Fire hazards. A burning smell, visible smoke or a smoke alarm means calling the fire service first and the building second, never sending staff in to look for the cause. Even if it proves a false alarm, that is the correct sequence. If there was a fire, the path is the same as for a warehouse: report, evidence, insurer, as set out in the first three days after a warehouse fire.

All three share one evidential rule: liability turns on where the source was, so photograph the source, not only the damage. When you sit down with the building, the neighbour and the insurer after the holiday, one clear photo of where the water came from is worth ten photos of your ruined floor.

System outage, account anomalies, compromised email: isolate first, and do not improvise a fix over the holiday

When a system or account behaves oddly during the holiday, the first move is isolation, not repair: change passwords, take affected accounts offline, suspend outgoing payments, and leave the rest to professionals when the office reopens or the vendor is reachable. Many security incidents grow because the person on duty restarted a machine, restored a backup or opened a suspicious email without the full picture.

By type of anomaly:

• Website or business system down. Distinguish a server problem from a domain or hosting expiry from a carrier outage. Domains and hosting that expire at year-end with a failed auto-renewal are a very common cause; check the registration mailbox for expiry notices. If the domain has already been taken or the site hijacked, see domain expired and website hijacked.
• Company email or social accounts sending content you did not write. A classic sign of compromise, and at year-end attackers use company accounts to push holiday promotions or bank detail changes to customers. Change passwords, enable two-factor authentication, sign out all devices and warn customers not to trust recent payment instructions from that account. Steps are in company website or social account hacked; if a customer has already paid a fraudulent account, follow business email compromise and diverted payments.
• Unfamiliar transactions in online banking. Call the bank's hotline to freeze the account or suspend online access immediately, even at night, then ask everyone with banking access to confirm they did not act.
• Emails asking you to re-login for a system upgrade or warning that an account will be suspended. Peak-season phishing. Do not click; log in from the official entry point to check.
• Files on the server or cloud drive encrypted or deleted. Disconnect from the network, do not attempt recovery, do not contact anything shown in a pop-up, and preserve the state for specialists.

If the anomaly touches personal data of customers or employees, such as client lists, ID copies or payroll files, you must assess whether it is a data breach and whether notification is required. That is a compliance obligation, not something fixed by restoring the system. The assessment and notification sequence is in responding to a customer data breach.

One practical tip: before the holiday, write every system's emergency contact on a single page, including the hosting provider, domain registrar, bank support line and the outsourced IT provider's on-call arrangement. The most time wasted in a holiday incident is searching old emails at midnight for a vendor's contact details.

Customers cannot reach anyone, complain publicly, or a contract date falls in the shutdown: respond first, explain second

The real cost of being unreachable over the holiday is not a few days of silence; it is what silence turns into: public complaints, platform reports, regulator complaints or termination. Speed of response matters more than content. Let the customer know someone exists, then deal with the substance.

Four typical holiday customer problems, each handled differently:

1. Urgent service requests. Your system is down for them, their shipment has a problem, equipment needs repair. At least one channel must produce a same-day reply, even if the reply is only that the request has been received and when someone will act. Before the shutdown, your website, social pages and email auto-reply should state the holiday contact route and response time, so customer expectations match your capacity.
2. Contract or payment dates inside the shutdown. A delivery date, payment date or renewal deadline lands in the holiday and neither side is working. Confirm an extension in writing before the holiday. If you did not, contact the counterparty on the first working day and get a written confirmation of the revised date; do not assume they understand. Whether a breach occurred depends on the contract wording, and disputes belong with a lawyer.
3. Public complaints. A customer posts negative content on social media or a review platform. Reply privately first, calmly: acknowledge receipt, explain the holiday arrangement, give a specific follow-up time. Do not argue facts in public. Handle any remedy or correction after the office reopens with full information.
4. Customers targeted by someone impersonating your company. Common at year-end: someone uses your name to send fake holiday promotions or account changes. When a customer asks whether it is you, answer clearly that it is not, post a warning on your official channels, and deal with your own account security as in the previous section. You can point customers to what to do after a Christmas-season scam for their own loss-control steps.

If nothing was arranged before the shutdown, the first task afterwards is to list every unanswered customer contact and reply to each with an explanation and a plan. Do not open with the fact that you were on holiday; open with the fact that you are back and this is the plan. Customers do not care why you did not answer, only what happens now.

After the holiday: quantify the loss, finish claims and filings, fix the system, and what Yixing can do

The post-holiday review is not about finding someone to blame. It is about converting the incident into next year's procedure: where there was no contact person, no backup, no insurance, nobody who knew whom to call. Work through four tasks:

One: quantify and document the loss. The list of missing or damaged assets and stock, repair and replacement quotes and invoices, and a record of business lost during the disruption. This one file serves the insurance claim, the tax treatment and your own year-end accounts. Stock losses must reconcile with the books; how to investigate and adjust differences is in handling a year-end inventory discrepancy. Any tax treatment of the loss follows the tax authority's current rules on procedure and documentation and should be handled by your accountant.

Two: complete claims and recovery. Submit the insurance file within the policy's time limits with the police report, building records, photographs and lists; none can be omitted. Where a third party is responsible (a leak from above, negligent building management, a vendor's system failure), make a written demand first, then negotiate, then assess legal action if negotiation fails.

Three: close the gaps. Most year-end incidents trace back to a handful of causes: no designated holiday duty officer, no one-page emergency contact sheet, alarms and CCTV not pushed to a phone, key accounts without two-factor authentication, insurance lapsing unnoticed, domain and hosting auto-renewals failing silently. None is expensive, but each needs an owner. For production businesses, holiday scheduling is covered in planning factory shutdowns around Philippine holidays.

Four: next year's pre-shutdown checklist. Close non-essential water and power, lift documents and equipment off the floor, back up data and actually test a restore, write the holiday contact route into auto-replies, give the building your holiday contact, confirm insurance is in force, and give duty staff a written rule for which situations require which call. The overall rhythm of the season is in surviving the Philippine Christmas season.

What Yixing can do: Yixing is a private consultancy registered with the Philippine SEC. Under a compliance retainer we can act as your company's local point of contact while management is abroad, coordinating with building management, insurers, accountants and lawyers, and running the police report, claim file and post-holiday registration updates in the right order. Yixing does not provide security services, does not replace insurance and cannot influence claim outcomes. → Compliance retainer and holiday cover

For liability, breach of contract and recovery in your specific case, consult a licensed attorney. This article is not legal advice.