Skip to content
Breach Index · running record

Ingram Micro data breach (2025): ransomware, a week of outage, and 42,521 people notified

Ingram Micro is one of the world’s largest IT distributors, so its July 2025 ransomware attack stopped orders and licence provisioning for resellers and managed-service providers worldwide. Six months later it notified 42,521 employees and job applicants that their data had been taken. This is the running record.

Short answer

Was Ingram Micro hacked?

Yes. On 5 July 2025 Ingram Micro announced, and reported in a Form 8-K, that it had “recently identified ransomware on certain of its internal systems”, took systems offline and notified law enforcement. Ordering and licence provisioning were disrupted for several days; reporting says global operations were restored by 9 July.

In January 2026 Ingram Micro notified 42,521 people, mainly employees and job applicants, that files taken on 2–3 July 2025 included names, contact details, dates of birth, Social Security numbers, driver’s licence and passport numbers, and employment records. The SafePay group claimed the attack and 3.5TB of data; Ingram Micro has not named the attacker or said whether it paid.

Timeline at a glance

  1. 2–3 Jul 2025Files taken from internal storage (per notification letters). (Techzine)Confirmed
  2. 5 Jul 20258-K and press release: ransomware identified; systems taken offline. (SEC 8-K)Confirmed
  3. Jul 2025SafePay claims the attack and 3.5TB, via a GlobalProtect VPN. (Techzine)Unverified claim
  4. 9 Jul 2025Operations reported restored globally. (TechInformed)Reported
  5. 16 Jan 2026Letters to 42,521 employees and applicants (Maine AG filing). (TechInformed)Confirmed

Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Ingram Micro incident timeline, in detail

Confirmed = acknowledged by Ingram Micro, a regulator filing or a court. Reported = credible reporting Ingram Micro has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jul 2025ConfirmedRansomware / operational outage

Ransomware forces systems offline at a global IT distributor

What happened. Ingram Micro said it “recently identified ransomware on certain of its internal systems”, proactively took some systems offline, launched an investigation with outside cybersecurity experts and notified law enforcement. The outage disrupted ordering platforms and licence provisioning for partners.

Impact. Several days of disrupted ordering for resellers and MSPs; reporting says operations were restored globally by 9 July 2025.

Sources: Form 8-K, 5 Jul 2025 · Ingram Micro press release

Jul 2025 – Jan 2026ConfirmedData exfiltration

Employee and applicant data taken; 42,521 people notified

What happened. Notification letters dated 16 January 2026 say an unauthorised third party took files from internal storage systems on 2–3 July 2025. The Maine Attorney General filing lists 42,521 affected people.

Impact. Names, contact details, dates of birth, Social Security numbers, driver’s licence and passport numbers and work records such as performance reviews, varying by person. Two years of credit monitoring offered.

Sources: Techzine, Jan 2026 · TechInformed

Jul 2025Unverified claimThreat-actor claim

SafePay claims 3.5TB and VPN access

What happened. SafePay listed Ingram Micro on its leak site, claimed 3.5TB of data, and said it got in through the company’s GlobalProtect VPN. Ingram Micro has not confirmed the group, the volume or the entry point.

Impact. Unverified.

Sources: Techzine

Where the reports disagree

  • Who did it and how: SafePay claims responsibility and VPN entry; Ingram Micro has named neither.
  • Customer data: the notified population is employees and job applicants. Ingram Micro has not reported customer or partner data in the stolen files.

The pattern across the record

A distributor outage is everyone’s outage

Resellers and MSPs could not order or provision licences while Ingram Micro was down. A supplier’s ransomware is an availability incident for its customers before it is a data incident for anyone.

HR data is the payload

The notified data is employee and applicant records: identity numbers and reviews. HR file shares remain a favourite target because they hold identity documents in bulk.

What it means for Ingram Micro partners and affected staff — and what to do

For resellers and MSPs the lesson is continuity; for the people notified it is identity protection.

  1. 1.Have a second route to market

    Know how you would order, provision licences and invoice if your main distributor is offline for a week.

  2. 2.Freeze credit if you were notified

    Social Security, licence and passport numbers were taken. Use the monitoring offered and add a free credit freeze.

  3. 3.Patch and harden your own VPN

    Whatever the entry point here, internet-facing VPNs are the common one. Require MFA and patch fast.

    Edge VPN intrusion lab
  4. 4.Map supplier dependencies

    List the suppliers whose outage would stop your business, and the workaround for each.

    Risk Register

CISO takeaways

Rehearse ransomware

Outage, extortion and notification in one exercise.

Ransomware tool
Score critical suppliers

Distributors and platforms deserve continuity questions, not only security ones.

Vendor Risk Scorecard
Practise an edge-device intrusion

VPN gateways remain the front door.

Edge VPN Intrusion Lab
Map notification clocks

SEC 8-K, state AG notices and employee letters.

Notification clocks

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed October 30, 2026.

  1. 1.Ingram Micro Holding Corp Form 8-K — SEC EDGAR, 5 Jul 2025
  2. 2.Ingram Micro issues statement regarding cybersecurity incident — Ingram Micro, 5 Jul 2025
  3. 3.Ingram Micro data breach affects 42,000 individuals — Techzine, Jan 2026
  4. 4.Ingram Micro says July 2025 ransomware compromised data of more than 42,000 people — TechInformed, Jan 2026

Frequently asked questions

Was Ingram Micro hacked?

Yes. Ingram Micro identified ransomware on internal systems in early July 2025, took systems offline and disclosed it in an SEC 8-K on 5 July. Files were taken on 2–3 July.

How many people were affected by the Ingram Micro data breach?

42,521, according to Ingram Micro’s filing with Maine’s Attorney General. They are mainly employees and job applicants.

What data was stolen from Ingram Micro?

Names, contact details, dates of birth, Social Security numbers, driver’s licence and passport numbers, and employment records such as performance reviews, varying by person.

Who attacked Ingram Micro?

The SafePay ransomware group claimed it and said it took 3.5TB through a GlobalProtect VPN. Ingram Micro has not confirmed the attacker or whether it paid.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Oracle data breachTechnology

Oracle Health, legacy cloud logins and the EBS zero-day.

Salesforce data breachTechnology

Vishing and stolen OAuth tokens across customer tenants.

Workday data breachTechnology

A third-party CRM, business contacts, no tenant access.

Red Hat data breachTechnology

A consulting GitLab and claimed client engagement reports.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Ingram Micro. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout