Ingram Micro confirms ransomware attack disrupted systems over July 4 weekend

Information technology products and services giant Ingram Micro Holding Corp. has confirmed that it was targeted by a ransomware attack that resulted in disruption to its services over the July 4 long weekend.

The ransomware attack is believed to have first struck the company on July 3, when Ingram Micro’s website and ordering systems first went down. According to BleepingComputer, the attack involved the SafePay ransomware group.

SafePay first emerged in September 2024 and uses a double extortion tactic — both encrypting data and stealing it before then demanding a ransom payment to provide a decryption key and to promise not to reveal the stolen data. In a summary of the group in June, security firm Forta LLC noted that unlike many ransomware groups in 2025, SafePay designs and deploys its ransomware campaigns itself and does not rely on affiliates — a ransomware-as-a-service model — to attack potential targets.

While Ingram Micro did not confirm the type of ransomware involved, the company did say that upon learning of the issue, it took steps “to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures.” The company has also launched an investigation with leading cybersecurity experts, notified law enforcement and is working on restoring affected systems.

The ransomware attack has also raised concern among Ingram Micro’s customers, with Dark Reading reporting that one executive at a managed service provider cited fears that ransomware actors could use Ingram Micro platforms to access its network. The executive added that his company is removing third-party privileged access to its Microsoft tenant to close off the potential attack vector.

Though not officially confirmed, Bleeping Computer, citing sources, also claims that the threat actors breached Ingram Micro through its GlobalProtect VPN platform.

As for what may happen next, Rebecca Moody, head of data research at tech research site Comparitech, told SiliconANGLE that SafePay is known for both encrypting systems and stealing data, so if ransom demands aren’t met, it’s likely Ingram Micro will show up on SafePay’s data leak site in the coming days or weeks.

“Over the last couple of months, SafePay has stolen an average of 111 gigabytes of data from each victim, which can lead to significant breaches,” added Moody. “A prime example is Marlboro-Chesterfield Pathology, P.C., which was targeted by SafePay in January 2025, with the group allegedly stealing 30 gigabytes of data. The healthcare company subsequently issued data breach notifications to nearly 236,000 people.”

Photo: Ingram Micro

Enjoy the perfect blend of retro charm and modern convenience with the Udreamer Vinyl Record Player. With 9,041 ratings, a 4.3/5-star average, and 400+ units sold in the past month, this player is a fan favorite, available now for just $39.99.

The record player features built-in stereo speakers that deliver retro-style sound while also offering modern functionality. Pair it with your phone via Bluetooth to wirelessly listen to your favorite tracks. Udreamer also provides 24-hour one-on-one service for customer support, ensuring your satisfaction.

Don’t miss out—get yours today for only $39.99 at Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!