Ingram Micro Ransomware Onslaught (July 2025):
Here's a scenario to ruin your morning coffee: you call your IT guy because a server license won't activate. He can't help — because his supplier's entire ordering system is down. Not your systems. Not his. The $47-billion distributor they both buy from.
That's what happened in early July 2025, when Ingram Micro — one of the world's largest technology distributors, the company that puts hardware and software into the hands of resellers and managed service providers worldwide — got hit with ransomware. Its website went dark, its ordering platforms froze, and for the better part of a week, a huge slice of the IT supply chain simply… stopped.
What happened
In the early hours of Thursday, July 3, 2025, Ingram Micro discovered ransomware on some of its internal systems. The company did what you're supposed to do: it proactively shut down affected systems to contain the damage, launched an investigation with outside cybersecurity experts, and notified law enforcement.
The outage was immediate and visible. Ingram Micro's website and online ordering went down, along with its AI-powered Xvantage distribution platform and its Impulse license provisioning system — meaning resellers and IT providers couldn't place orders, provision software licenses, or get shipments moving. (Notably, everyday tools like Microsoft 365, Teams, and SharePoint kept running.) The company confirmed the ransomware attack publicly on July 5–7 and had operations restored around July 10.
According to BleepingComputer's reporting, the ransom note found on company devices pointed to the SafePay ransomware gang, one of 2025's most active operations. Sources said the attackers likely got in through the company's GlobalProtect VPN using compromised credentials — though Palo Alto Networks later clarified its product itself wasn't exploited or breached. SafePay later claimed to have stolen 3.5 terabytes of data, a claim that couldn't be independently verified.
The fallout continued for months: breach notification filings later revealed that employment and job-applicant records for 42,521 individuals were taken, including names, contact information, dates of birth, and government ID numbers such as Social Security and driver's license numbers.
Why this matters to your small business
Three lessons here, and none of them require you to be a $47-billion company to learn from.
First: your supply chain is your problem now. When a distributor goes dark for a week, it's not their customers who feel it most — it's their customers' customers. If your IT provider depends on a supplier for hardware, licenses, or cloud provisioning, their outage becomes your delay. Ask yourself: if a key supplier vanished for seven days, what would stop working in your business?
Second: the front door was a stolen password. Not a zero-day exploit, not a nation-state operation — compromised VPN credentials. This is the single most common way ransomware gets into small businesses too. One employee reusing a password, one VPN login without multi-factor authentication, and the attackers are inside your network browsing around like they own the place.
Third: give Ingram Micro credit for the response. They found it, shut things down fast, brought in experts, told the truth publicly, and were back up in about a week. That's what a real incident response looks like. Most small businesses don't have a plan at all — which means their response to ransomware is panic, not procedure.
4 things to do this week
1. Put multi-factor authentication on every remote door. VPN, remote desktop, email, cloud admin consoles — everything reachable from the internet. A stolen password without MFA is an open door; with MFA, it's a dead end. This one control would have stopped the Ingram Micro attack at the gate.
2. Make sure your backups would actually save you. Backups that live on the same network as everything else get encrypted along with everything else. You need offline or immutable copies — and you need to have tested restoring from them. An untested backup is a hope, not a plan.
3. Map your dependencies. Write down the three suppliers or services your business can't function without for a week — your internet provider, your payment processor, your IT vendor's distributors. Then ask each of them what their backup plan is. You'll be surprised how few have a good answer.
4. Write your incident response plan on one page. Who do you call first? What gets disconnected first? Who talks to customers? Ingram Micro's fast shutdown limited the damage enormously. Your plan doesn't need to be fancy — it needs to exist before you need it.
The bottom line
If ransomware can take down the company that sells cybersecurity tools to IT providers, it can take down anyone. The difference between a bad week and a business-ending event isn't luck — it's preparation: MFA on every door, backups that work, and a plan you've actually rehearsed.
That's precisely what a managed IT provider is for. Mojave IT Pros provides managed IT and cybersecurity for small and medium businesses across the Las Vegas Valley — proactive monitoring, tested backups, and incident response planning, so a ransomware attack becomes an inconvenience instead of a catastrophe. Book a free 30-minute consultation and let's talk about your business.
Sources:
