A ransomware attack on the IT distributor Ingram Micro began in the early hours of 3 July 2025 and disrupted order processing and communications for days. The company confirmed ransomware on 6 July. The reported entry point, a VPN with valid credentials, rests on unnamed sources and was not confirmed by the company.
What is confirmed
CyberInsider's report says employees found ransom notes on compromised systems on 3 July, and that the first official statement came on Sunday 6 July, after several silent days. The company shut down affected environments, started an investigation with outside experts and notified law enforcement.
Customers reported that the website and backend systems were unreachable, phone lines unresponsive and email failing. The reporter, citing unnamed sources, says its Xvantage platform and Impulse licensing tool were down while Microsoft 365, Teams and SharePoint stayed up. The company had not confirmed a data breach or data theft at the time.
What is not confirmed
The reported entry point was a GlobalProtect VPN, through stolen credentials or password spraying. The article rates the reliability of that claim as low to moderate, because it rests on anonymous insider sources and unverified forum posts. Concerns about downstream effects on cloud providers that rely on the distributor's licensing are described as speculation. Use these as hypotheses only.
Why distributor outages hurt
A distributor sits between vendors and thousands of resellers. When it is down, resellers cannot place orders, provision licences or check quotes. Their customers feel it a day or two later.
What resellers and customers can do
- Know which of your processes depend on a single distributor, and which have a second source.
- Keep an offline copy of key contract, licence and renewal data.
- Agree an out of band contact route with each supplier, since email and phone may fail together.
- Review who holds administrative delegation into your cloud tenants through a partner, and limit it.
- Ask suppliers for their notification commitment and test it.
- Prepare a customer message in advance for when a supplier outage affects delivery dates.
What to look for on the defence side
If the entry point was VPN credentials, the control list is familiar: multi-factor authentication on every remote access path, password spray detection, alerting on logins from unusual places, and short session lifetimes. Whether or not this was the route here, those controls close the common ones.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation can help you track suppliers and their access to your systems. It is not a VPN or an EDR product. A free scan is at gold.safeguard.sh/scan.
Quick check
Did Ingram Micro confirm how attackers got in?
No. The VPN credential route comes from unnamed sources cited in press reporting and is unconfirmed.
Was data theft confirmed in the first reports?
No. The company had not confirmed a data breach at the time of the report.
Sources
Last reviewed: 19 October 2026.
