Ingram Micro outage caused by SafePay ransomware attack

An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned.

Ingram Micro is one of the world’s largest business-to-business technology distributors and service providers, offering a range of solutions including hardware, software, cloud services, logistics, and training to resellers and managed service providers worldwide.

Since Thursday, Ingram Micro’s website and online ordering systems have been down, with the company not disclosing the cause of the issues.

BleepingComputer has now learned that the outages are caused by a cyberattack that occurred early Thursday morning, with employees suddenly finding ransom notes created on their devices.

The ransom note, seen by BleepingComputer, is associated with the SafePay ransomware operation, which has become one of the more active operations in 2025. It is unclear if devices were actually encrypted in the attack.

It should be noted that while the ransom note claims to have stolen a wide variety of information, this is generic language used in all SafePay ransom notes and may not be true for the Ingram Micro attack.

Do you have information about this or another cyberattack? If you want to share the information, you can contact us securely and confidentially on Signal at LawrenceA.11, via email at [email protected], or by using our tips form.

Sources have told BleepingComputer that it is believed the threat actors breached Ingram Micro through its GlobalProtect VPN platform.

Once the attack was discovered, employees in some locations were told to work from home. The company also shut down internal systems, telling employees not to use the company’s GlobalProtect VPN access, which was said to be impacted by the IT outage.

Systems that are impacted in many locations include the company’s AI-powered Xvantage distribution platform and the Impulse license provisioning platform. However, BleepingComputer was told that other internal services, such as Microsoft 365, Teams, and SharePoint, continue to operate as usual.

As of yesterday, Ingram Micro has not disclosed the attack publicly or to its employees, only stating there are ongoing IT issues, as indicated by company-wide advisories shared with BleepingComputer.

The SafePay ransomware gang is a relatively new operation that was first seen in November 2024, accumulating over 220 victims since then.

The ransomware operation has been previously observed breaching corporate networks through VPN gateways using compromised credentials and password spray attacks.

BleepingComputer contacted Ingram Micro yesterday and today about the outages and ransomware attack, but did not receive a response to our emails.