Ingram Micro Confirms Ransomware Attack: Impact on IT Distribution and Services

Ingram Micro, a leading IT product distributor, has confirmed a ransomware attack. The attack impacted the company's operations and customer data. Ingram Micro offers a range of IT products, cloud services, and logistics expertise through three main lines of business: Technology Solutions, Cloud, and Other. The company's technology solutions include client and endpoint solutions, advanced solutions, and cloud-based solutions.

Ingram Micro, a leading IT product distributor, has confirmed a ransomware attack that has significantly impacted its operations and customer data. The attack, which occurred on July 3, has led to widespread disruptions, including the inability to place orders and manage services. The company has been working diligently to restore affected systems and has apologized for any disruptions caused to customers and partners.

According to The Register [1], Ingram Micro discovered ransomware on certain internal systems and promptly took steps to secure the affected environment. The company has launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement. The attack has been attributed to the SafePay ransomware crew, which has claimed responsibility and demanded a ransom for the decryption of encrypted data.

The attack has caused significant disruptions, with orders for physical products and the management of Microsoft 365 and Dropbox licenses being affected. Ingram Micro's Bulgaria-based service center was also impacted, with staff being sent home and asked to keep their laptops disconnected. The company's website and online ordering systems have been down since Thursday, and the outage has raised concerns among partners and customers.

The SafePay crew has claimed that they exploited misconfigurations in Ingram's network to gain access. The ransom note from the crew states that they have encrypted sensitive and confidential information, including financial statements, intellectual property, and customer files. The note also claims that the crew has blocked Ingram's servers and will unlock them once an agreement is reached.

The attack has highlighted the vulnerability of large IT distributors to ransomware attacks. Ingram Micro's silence in the initial stages of the attack has raised concerns among partners and customers, who have expressed their frustration with the lack of communication. The company's failure to communicate the extent of the outage has led some partners to consider alternative sources for products.

The attack has significant financial implications for Ingram Micro. The company generated revenues of $48 billion in its prior financial year and recorded a profit of $262.2 million. The disruption to service, even for a day, can have a significant impact on the company's operations and financial performance.

Ingram Micro's response to the attack has been criticized by some partners and customers, who have called for more transparent communication and faster resolution. The company has been working to restore affected systems and has apologized for any disruptions caused. However, the lack of communication has raised concerns about the company's ability to manage the situation effectively.

The attack has also raised questions about the effectiveness of Ingram Micro's cybersecurity measures. The company has been criticized for not implementing multi-factor authentication on all remote access points and for not disabling unused RDP or VPN access. These measures could have helped prevent the attack from occurring.

In conclusion, Ingram Micro's ransomware attack has caused significant disruptions to its operations and customer data. The attack has highlighted the vulnerability of large IT distributors to ransomware attacks and the importance of effective cybersecurity measures. The company's response to the attack has been criticized for its lack of communication and transparency. The attack has significant financial implications for Ingram Micro and raises questions about the company's ability to manage the situation effectively.

References:
[1] https://www.theregister.com/2025/07/06/ingram_micro_confirms_ransomware_behind/
[2] https://www.crn.com/news/security/2025/ingram-micro-hit-by-safepay-ransomware-attack-report