14-hour+ global blackout at Ingram Micro halts customer orders

HELLFIRE

https://www.theregister.com/2025/07/04/ingram_micro_technical_difficulties/

Exclusive Widespread outages across Ingram Micro’s websites and client service portals are being attributed to “technical difficulties.” … Another individual claimed that staff at Ingram’s service center in Bulgaria, which covers a large chunk of European sales, have all been sent home and told to keep their laptops disconnected amid a total internal system shutdown. …

Not stated to be Security related YET, but the line about the laptops twigs my security radar…

Regards

HELLFIRE

https://www.bleepingcomputer.com/news/security/ingram-micro-outage-caused-by-safepay-ransomware-attack/ – Ingram Micro outage caused by SafePay ransomware attack

An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned. … Sources have told BleepingComputer that it is believed the threat actors breached Ingram Micro through its GlobalProtect VPN platform; systems that are impacted in many locations include the company’s AI-powered Xvantage distribution platform and the Impulse license provisioning platform, however, BleepingComputer was told that other internal services, such as Microsoft 365, Teams, and SharePoint, continue to operate as usual. …

FWIW.

Regards

HELLFIRE

TheRegister confirms as well : https://www.theregister.com/2025/07/06/ingram_micro_confirms_ransomware_behind/

… The distributor said: “Ingram Micro recently identified ransomware on certain of its internal systems. Promptly after learning of the issue, the company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement. …

Regards

HELLFIRE

https://www.theregister.com/2025/07/09/ingram_micro_restarts_orders_for/ – Ingram Micro restarts orders – for some – following ransomware attack

Ingram Micro says it is gradually reactivating customer’s ordering capabilities across the world, region by region, now its ransomware attack is thought to be “contained”. … “We have implemented additional safeguards and monitoring measures to protect our network environment as we bring our systems back online,” it added. …

Regards

HELLFIRE

https://www.theregister.com/2025/07/30/ingram_micro_ransomware_threat/ – Ransomware gang sets deadline to leak 3.5 TB of Ingram Micro data

… The SafePay ransomware group posted Ingram Micro to its leak blog on July 29, saying it intends to release 3.5 TB of company data on August 1. … Ingram Micro has not updated its public information page about the ransomware attack since July 9, the day it says it restored global business operations. …

Regards

HELLFIRE

https://www.theregister.com/2026/01/19/ingram_micro_ransomware_affects/ – Maine filing confirms July attack affected 42,521 employees and job applicants

… The distributor’s filing with the attorney general’s office in Maine confirmed the total number of affected people as 42,521. A letter is being sent to each explaining that employee and job applicant records were affected. …

Regards