These sorts of cyberattacks are more common than most might think and make up a large part of the cybercrime industry. According to the FBI, American companies have lost $12 billion to BEC attacks. The good news is there are ways to protect yourself and your company.
I once worked somewhere that required an all-office email if you were going to be late, if you had an appointment, etc. I hated that. No one needed to know I was going to the dentist, but it was policy so I did it.

6.) Herzlich willkommen bei Mustermann. Unsere Telefon-Hotline ist über die Festtage nicht besetzt. Genaue Öffnungszeiten erfahren sie auf unser Website unter www.mustermann.de. Wir bedanken uns für Ihr Vertrauen und wünschen Ihnen und Ihren Lieben erholsame Feiertage und ein gutes neues Jahr.
I might sound nitpicky but the language is important. “Might” or “may be” or “slower than usual” are vague and don’t offer the sender all that much information about when you’re really going to respond to them. Worse, they do a horrible job of protecting the time of the email receiver who, as the responder notes, is not in the office! Such a responder implies that, not only will the vacationer reply to the email, but they may not even miss a beat. They may be slow to respond, but they also might not.