Ingram Micro Disrupted by SafePay Ransomware Attack, Global Operations Affected

SafePay is a ransomware issue that hit Ingram Micro, one of the global leaders in the distribution of IT, wanting to get back on track with its logistics, licensing, and support tools. Starting on July 3, 2025, the company had to shut down major internal platforms, including the Xvantage portal and VPN services, which impacted activities in North America, Europe, and Asia.

According to cybersecurity sources, the SafePay ransomware attack exploited vulnerabilities in Ingram’s remote access infrastructure, specifically through stolen credentials linked to its Palo Alto GlobalProtect VPN. Inside the network, the attackers had applied ransomware that secured important systems and placed ransom messages on the devices of the employees. The rapid response that contained the spread was initiated by the company, and the attack did result in major operations delays in order processing and partner and managed service provider licensing.

SafePay is a relatively new ransomware group that, since late 2024, has been connected to more than 220 attacks, thought to be misusing sensitive corporate data, including financial data, law and legal records, customer data, and so on. The extent of the data exfiltration is not recognized by Ingram Micro, however, it has reported to regulatory and law enforcement agencies, and researchers of the exchange, and has been cooperating with cybersecurity firms to investigate.

SafePay ransomware assault highlights the persistent dangers of IT supply chains internationally and demonstrates the significance of more powerful protective measures, such as multi-factor verification, network and segmentation, and zero-trust structures. It will require more time to recuperate, but this is a valuable lesson to Delta and others in the industry that ransomware is gaining momentum even among industry heavyweights.

---