Ingram Micro confirms ransomware behind multi-day outage

Ingram Micro experienced a ransomware attack (claimed by the SafePay group) beginning 3 July 2025 that caused systems and phone lines to go down, prevented order placement and license management, and forced staff to disconnect devices; SafePay claims they encrypted files and exfiltrated sensitive financial, IP, accounting, legal, and customer data, possibly gaining access via a GlobalProtect VPN misconfiguration or stolen credentials. The company has taken affected systems offline, engaged cybersecurity experts, notified law enforcement, and is working to restore services while the extortion claim remains under investigation and unverified.