Ingram Micro, a major global IT distributor, has confirmed that a ransomware attack was responsible for the ongoing system outage that began late last week.
HIghlights
- Confirmed Ransomware Attack: Ingram Micro disclosed that a ransomware breach caused its ongoing system outage, disrupting services since July 3.
- Major Operational Disruption: Software provisioning, order processing, and internal systems are affected, impacting clients across critical sectors.
- Timeline of Events: Outage started on July 3; restoration efforts began by July 6; official confirmation issued July 8 before U.S. markets opened.
- Suspected Attacker – SafePay: Cybersecurity experts believe the SafePay group is behind the attack, likely entering through a misconfigured VPN gateway.
- SafePay’s Attack Style: Known for double-extortion tactics—stealing data and threatening to leak it if ransom is not paid, usually within 7 days.
- No Ransom Note Publicly Seen: Ingram has not revealed if any ransom demands were made or if customer data has been compromised.
- Critical Supply Chain Ripple: The attack threatens downstream vendors and public infrastructure that rely on Ingram’s managed IT and cloud services.
- Immediate Response Measures: The company has engaged law enforcement and cybersecurity experts to isolate systems and initiate recovery efforts.
The disruption has impacted core services and delayed order processing across multiple regions, affecting both the company and its global network of clients.
Timeline of the Incident
The outage began on Thursday, July 3, when Ingram’s website and internal systems were abruptly taken offline. By Saturday evening, the company released a short statement indicating that it had begun restoration efforts.
The official confirmation of a ransomware attack came on Monday, in a notice to shareholders issued before U.S. financial markets opened.
Scope of the Disruption
While full technical details remain limited, the impact has been significant:
- Software license provisioning was among the affected services, leaving many clients unable to access or deploy products reliant on Ingram Micro’s backend systems.
- As of the latest update, no ransom demand or data leak has been publicly confirmed.
- Company spokesperson Lisa Zwick has not yet responded to requests for comment.
Ingram Micro, headquartered in California, serves as a key IT supply chain partner for resellers, telecoms, government agencies, and Fortune 500 companies, in addition to offering managed cloud services for small and medium-sized businesses.
SafePay Ransomware Group
Although no cybercriminal group has claimed responsibility, cybersecurity site Bleeping Computer reports that the SafePay ransomware gang is likely behind the attack. Sources close to the matter indicate that:
- The attackers may have gained access through a misconfigured GlobalProtect VPN—a vulnerability that allowed for lateral movement within Ingram’s internal network.
- SafePay allegedly referred to the breach as a “paid training session” for Ingram’s IT team, citing systemic weaknesses in infrastructure.
SafePay has emerged as a major threat actor since its appearance in late 2024. By mid-2025, it had claimed over 220 victims, ranking among the world’s top four most active ransomware groups.
Unlike affiliate-based ransomware models, SafePay reportedly maintains full control over its operations and tools.
Common Ransomware Tactics
According to security analysts, SafePay typically employs a double-extortion model. Victims receive ransom notes warning that stolen data—including financial records, intellectual property, and customer information—will be published if demands are not met.
The group often provides a seven-day window for negotiation, offering to keep the breach private in exchange for payment.
In this case, no ransom note has been made public, and Ingram has not commented on whether any data was exfiltrated.
A Critical Supply Chain Disruption
Experts describe the incident as a “critical inflection point” for IT distribution, given Ingram Micro’s central role in supporting infrastructure for thousands of partners. The disruption could lead to:
- Delayed product rollouts for downstream vendors
- Service interruptions for clients in telecom, healthcare, retail, and government sectors
- Extended outages for businesses relying on Ingram’s managed IT services
“This isn’t just an internal outage,” noted cybersecurity analyst Jonathan Reyes. “It’s a systemic shock that echoes across the broader digital supply chain.”
Mitigation and Response Efforts
Ingram Micro reports that it immediately shut down affected systems and brought in both cybersecurity experts and law enforcement to contain the breach and initiate recovery protocols.
The company is working to restore critical services, though a full timeline for recovery has not yet been provided.
