SafePay ransomware, which brought Ingram Micro’s global order systems to a grinding halt, served as a jarring reminder of rising cyber threats in the IT supply chain. The disruption affected thousands of resellers and managed service providers, underscoring the vulnerabilities in third-party platforms and the urgent need for cyber resilience.
Ingram Micro is one of the world’s largest business-to-business technology distributors and service providers. They serve as a vital link between technology manufacturers and the businesses that sell and implement those technologies. Let’s take a deep dive into its ransomware situation and impact.
Who is SafePay?
SafePay is a ransomware attack group that has been in operation since late 2024. The group has since made headlines as one of the most active ransomware groups globally.
They have since claimed credit for over 200 ransomware attacks that occurred from late 2024 until July 2025. Their modus operandi:
- Exploit VPN credentials or vulnerabilities in the network about to be hacked.
- Gain initial access, then deploy malware to encrypt their victim’s systems.
- Exfiltrate sensitive data
- Threaten public data leaks unless a ransom is paid
What Happened?
According to BleepingComputer, it was initially believed the ransomware used by the attackers gained access to Ingram Micro’s internal system through Palo Alto’s GlobalProtect VPN gateway through compromised credentials.
The claim was later debunked by Palo Alto Networks that their VPN was not the source of vulnerability for the breach.
Although it is not fully clear as to how the ransomware gained access to Ingram Micro’s system, as investigations are ongoing, here’s what we know happened in relation to the attack:
- The attack occurred in the early hours of Thursday, July 3, with employees finding ransom notes on their devices.
- The ransom note was identified as one of SafePay’s strategies, as it bore similar markers with notes used in other attacks by the cyber group.
- On July 4, the company recognized the severity of the situation, and proactive measures were taken to shut down the system, causing a global blackout to contain the spread of the ransomware.
- The shutdown included critical platforms like their Xvantage distribution platform and Impulse license provisioning system vital for order processing, software licensing, and partner services.
- On July 5, the company announced officially that it had identified ransomware on its internal system.
- Early reports speculated the attackers gained access through the company’s GlobalProtect VPN; however, this was not confirmed by Ingram Micro, and later it was debunked by Palo Alto (Ingram Micro’s partner and owner/developer of GlobalProtect VPN).
- From July 7 to 9, the company began phased restoration of its systems, with the company going back to full operational capabilities globally by 9:50 PT on July 9.
- It is speculated that SafePay was behind the ransomware attack due to the markers in the ransom note sent. SafePay, however, has not taken credit for the attack, and Ingram Micro has not verified it was done by them.
The impact following the attack was severe on a global scale due to delayed order processing, significant shipment backlogs, and interruptions in software licensing across popular platforms like Microsoft 365 and Dropbox. This not only led to financial loss for Ingram Micro and its partners but also has temporarily damaged Ingram’s reputation for supply chain reliability.
A Wake-up Call for Businesses Worldwide
Although investigations are still ongoing regarding circumstances regarding the attack, and operations at Ingram Micro are back to normal, the ransomware incident serves as a stark warning to organizations of all sizes.
Organizations in the supply chain industry are implored to take steps to bolster cybersecurity defense systems. Here are key takeaways to be learned and implemented:
- Harden Remote Access Infrastructure: although a compromised VPN was not confirmed to be the entry point for this attack, it is one commonly used by ransomware groups like Safepay.
Measures should be taken to secure your VPN gateways with robust configurations and enforce strong authentication, especially Multi-Factor Authentication (MFA), for all remote access and privileged accounts.
- Network Segmentation: segmenting your network will limit movement by attackers even if they breach an initial point.
- Incident Response Plan: develop and regularly have drills for a comprehensive incident response plan. Knowing what to do before an attack happens can significantly lessen the damage.
- Employee Training: human error is a significant vulnerability, and it will always remain so. To get around this, employees should have regular workshops on how to identify phishing attacks, social engineering, and the importance of strong security practices.
- Robust Backup and Recovery: Having an immutable and up-to-date backup system is a last line of defense against data loss due to ransomware.
By prioritizing cyber resilience and staying vigilant against evolving attack techniques, businesses can better protect their operations and reduce the rate of ransomware attacks on a global scale.
