IT company Ingram Micro says ransomware targeted internal systems

One of the U.S.'s biggest providers of IT products and services said it was hit with ransomware ahead of the July 4 holiday weekend. 

Ingram Micro published a statement on Saturday saying it discovered “ransomware on certain of its internal systems,” which it immediately took offline. 

“The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement,” the company said.

“Ingram Micro is working diligently to restore the affected systems so that it can process and ship orders, and the Company apologizes for any disruption this issue is causing its customers, vendor partners, and others.”

The company declined to provide an update about the situation when contacted by Recorded Future News on Monday. 

The company reported $48 billion in sales over the last fiscal year through its position as a connector between organizations and technology manufacturers that provide hardware, software and cloud services. Ingram Micro has more than 50 offices across the Americas, Europe, Asia and the Middle East.  

The outages at Ingram Micro were first reported by BleepingComputer on Thursday, which later reported the attack was launched by the SafePay ransomware gang. 

Cybersecurity expert Rebecca Moody said her team at research firm Comparitech has tracked 238 attacks by the SafePay group, including recent incidents affecting government technology contractor Conduent and British tech company Microlise.

“Over the last couple of months, SafePay has stolen an average of 111 GB of data from each victim, which can lead to significant breaches,” Moody said. 

“A prime example is Marlboro-Chesterfield Pathology, P.C., which was targeted by SafePay in January 2025 with the group allegedly stealing 30 GB of data. The healthcare company subsequently issued data breach notifications to nearly 236,000 people."