SafePay Ransomware Threatens Ingram Micro with 3.5TB Data Release

Global technology distributor Ingram Micro is facing an escalating crisis as the SafePay ransomware group has threatened to release 3.5 terabytes of allegedly stolen data by August 1st. This ominous development comes weeks after Ingram Micro was hit by a significant cyberattack earlier in July, which caused widespread disruption to its global operations.

The SafePay group, a relatively new but increasingly active player in the cybercrime landscape, listed Ingram Micro as a victim on its dark web leak site on July 29th. This move is a common “double extortion” tactic employed by ransomware gangs, aiming to pressure victims into paying a ransom by threatening to publicly expose sensitive data if their demands are not met. While Ingram Micro swiftly moved to restore its systems and declared global operations largely recovered by July 9th, the company has remained tight-lipped regarding the specifics of the attack, including whether SafePay was indeed the culprit or if data was exfiltrated.

Sources familiar with the incident indicate that the initial breach may have occurred through Ingram Micro’s GlobalProtect VPN platform, a known target for credential-based attacks. SafePay is notorious for using such methods, often leveraging stolen credentials or employing password-spraying techniques to gain initial access to corporate networks. Once inside, they typically exfiltrate large volumes of data before deploying ransomware to encrypt systems.

The potential release of 3.5TB of data raises serious concerns about the scope of the breach and the nature of the compromised information. As one of the world’s largest B2B technology distributors, Ingram Micro handles a vast amount of sensitive data belonging to its customers, partners, and employees, including financial, legal, and intellectual property. A public leak could have far-reaching consequences, impacting not only Ingram Micro’s reputation and financial standing but also the security and privacy of countless entities within the global IT supply chain.

Despite Ingram Micro’s assurance of restored operations, some of its systems and websites were observed to be coming back online only this week, suggesting a more prolonged recovery than initially communicated. The company has since implemented organization-wide multi-factor authentication and performed a complete reset of employee passwords as part of its remediation efforts.

The SafePay group has rapidly gained prominence since its emergence in late 2024, known for its aggressive tactics and a high volume of claimed victims. Their rise follows the decline of other notorious ransomware operations, highlighting the ever-evolving threat landscape faced by major enterprises. As the August 1st deadline looms, the cybersecurity community and Ingram Micro’s stakeholders are keenly watching for further developments in this high-stakes standoff.