Ingram Micro confirms ransomware behind multi-day outage.

Global technology distributor Ingram Micro has confirmed that a ransomware attack is responsible for a multi-day system outage that has severely impacted its operations worldwide. The disruption, which began on Thursday, July 3rd, has left customers unable to place orders and employees locked out of critical internal systems, causing significant ripple effects across the IT supply chain.

In a statement released over the weekend, Ingram Micro acknowledged the presence of ransomware on “certain of its internal systems.” The company immediately took steps to secure its environment, including proactively taking affected systems offline, and has launched a thorough investigation with the assistance of top cybersecurity experts. Law enforcement has also been notified of the incident.

Sources close to the investigation, as reported by cybersecurity news outlets, indicate that the outage is linked to the “SafePay” ransomware operation. The SafePay group, a relatively new but highly active threat actor in 2025, is believed to have breached Ingram Micro’s systems via its GlobalProtect VPN platform. Ransom notes discovered on company devices reportedly demand payment within seven days, though it remains unclear if data was also exfiltrated.

The impact on Ingram Micro’s vast network of customers and vendor partners has been substantial. The company’s main website, ingrammicro.com, has been largely inaccessible, displaying maintenance or access restricted messages. Key operational platforms, including its AI-powered Xvantage distribution system and the Impulse license provisioning platform, have been affected, hindering the processing and shipment of orders globally.

While Ingram Micro has apologized for the disruption and stated it is “working diligently to restore the affected systems,” a definitive timeline for full recovery has not been provided. The incident underscores the escalating threat of ransomware to critical supply chain companies, highlighting the potential for widespread operational and financial consequences. The lack of immediate and consistent communication from Ingram Micro in the initial days of the outage also drew criticism from frustrated partners.

Cybersecurity experts emphasize that such attacks often exploit vulnerabilities in legacy systems, misconfigurations, or compromised credentials. This incident serves as a stark reminder for all organizations, particularly those at the heart of global supply chains, to prioritize robust cybersecurity measures, including multi-factor authentication and vigilant vulnerability management, to protect against increasingly sophisticated cyber threats.