INCIDENT REPORT · CP-2025-011

Ingram Micro ransomware attack

L2 · GUARDEDCONFIRMED

IT distributor Ingram Micro identified ransomware on internal systems and proactively took systems offline, causing a multi-day global outage of its ordering and licensing platforms.

Incident ID: CP-2025-011
Incident date: 03 JUL 2025
Detection date: 03 JUL 2025
Affected countries: United States
Plotted location: Irvine, California, United States (Affected organization headquarters)
Threat classification: Level 2 — GUARDED
Classification rationale: Global disruption at a major IT distributor, but short-lived and largely commercial.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Technology, Logistics
Critical infrastructure: No
Organizations affected: Ingram Micro
Operational consequences: Ordering platforms including Xvantage and license provisioning were disrupted for about a week, affecting resellers and managed service providers worldwide; the company reported operations restored by around 9-10 July 2025.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Claimed by SafePay ransomware group; not confirmed by Ingram Micro

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Ingram Micro ransomware attack

L2 · GUARDEDCONFIRMED

IT distributor Ingram Micro identified ransomware on internal systems and proactively took systems offline, causing a multi-day global outage of its ordering and licensing platforms.

Incident ID

CP-2025-011

Incident date

03 JUL 2025

Detection date

03 JUL 2025

Affected countries

United States

Plotted location

Irvine, California, United States (Affected organization headquarters)

Threat classification

Level 2 — GUARDED

Classification rationale

Global disruption at a major IT distributor, but short-lived and largely commercial.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Technology, Logistics

Critical infrastructure

Organizations affected

Ingram Micro

Operational consequences

Ordering platforms including Xvantage and license provisioning were disrupted for about a week, affecting resellers and managed service providers worldwide; the company reported operations restored by around 9-10 July 2025.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Claimed by SafePay ransomware group; not confirmed by Ingram Micro