Global IT Distributor Ingram Micro suffers outage disrupting global operations, suspected ransomware
Learn More
Ingram Micro, one of the world's largest business-to-business technology distributors, is experiencing a global outage that began on July 3, 2025, around 8 PM UTC.
The incident has rendered the company's websites, customer portals, and internal systems inaccessible for more than 48 hours, affecting thousands of partners and customers who rely on the distributor for technology services and products.
The incident characteristics suggest a ransomware attack. Ingram Micro has remained largely silent about the nature of the incident. Reports from multiple sources indicate that employees at the company's service center in Bulgaria, which handles a significant portion of European sales operations, have been sent home and instructed to keep their laptops disconnected. This type of response is commonly associated with ransomware attacks where organizations must isolate systems to prevent further damage and data encryption.
Customer service representatives who were reached after extended wait times reportedly told customers that the company believed it had been "targeted," indicating awareness of malicious intent rather than a technical malfunction.
Ingram Micro has not provided any information about whether customer data, partner information, financial records, or other sensitive business information may have been compromised.
Ingram Micro's main website displays only a brief maintenance message stating: "We are currently experiencing technical difficulties. We apologize for the inconvenience and are working to resolve the issue as quickly as possible." Other company domains show even more generic error messages referencing Akamai Technologies' EdgeSuite CDN. Some portal login pages appear to function normally and make no mention of the widespread issues.
Update - BleepingComputer reports that the Ingram Micro outage is caused by a SafePay ransomware attack discovered on Thursday, 3rd of July 2025. The company believes attackers breached through its GlobalProtect VPN platform. The attack has forced Ingram Micro to shut down internal systems including its AI-powered Xvantage distribution platform and Impulse license provisioning platform. The company is directing employees to work from home and avoid using the compromised VPN access.
As of 6th of July 2025, Ingram Micro, confirmed that the company has been hit with a ransomware attack. In a statement, Ingram Micro said:
"Ingram Micro recently identified ransomware on certain of its internal systems. Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement.
Ingram Micro is working diligently to restore the affected systems so that it can process and ship orders, and the Company apologizes for any disruption this issue is causing its customers, vendor partners, and others."
As of 9th of July 2025, Palo Alto Networks denied reports that its GlobalProtect VPN was involved in the attack, claiming that none of its products were the source of the vulnerability or impacted by the breach.
As of 30th of July, the SafePay ransomware gang is threatening to leak 3.5TB allegedly stolen from Ingram Micro. The company has not confirmed that SafePay ransomware was behind the breach and has not disclosed if attackers stole data.
As of 19th of January 2026, Ingram Micro reports that the ransomware attack compromised personal data of 42,521 employees and job applicants. Exposed data includes:
- names,
- contact information,
- dates of birth,
- Social Security numbers,
- passport numbers,
- driver's license numbers.
