In the wake of a significant IT disruption, global technology distributor Ingram Micro has confirmed that a ransomware attack was responsible for the chaos. The company, based in California and a major player in tech product distribution and cloud services, acknowledged that a cyber assault had compromised its internal systems. This breach caused a major outage, affecting software licensing services and preventing customers from accessing certain products dependent on Ingram Micro’s backend infrastructure. The incident has been traced back to the notorious SafePay ransomware group, which has been active since late 2024 and has targeted over 220 victims globally.

Ingram Micro, with reported sales nearing $48 billion in 2024, is now grappling with the aftermath of this attack. In a recent filing with U.S. regulators, the company directed stakeholders to a prior press release for further details, underscoring the severity of the situation. The attack appears to have utilized the same ransom note format previously linked to SafePay, a group known for its aggressive tactics. Despite the disruption, it remains unclear whether the attackers managed to exfiltrate any data or encrypt critical systems.

The SafePay group has a history of breaching organizations through vulnerabilities in VPN gateways, often using stolen credentials. Reports suggest that Ingram Micro’s systems were compromised via the Palo Alto GlobalProtect VPN, a method previously documented in other SafePay attacks. The cybersecurity community is on high alert as it investigates the breach, emphasizing the need for robust protection against stolen credentials and network misconfigurations.

SafePay’s tactics are sophisticated, often involving the exploitation of remote desktop protocol endpoints and misconfigured systems. The group employs a variety of techniques to disable security features, escalate privileges, and terminate critical processes, thereby maximizing disruption and enhancing their extortion efforts. Their signature move includes encrypting files with a .safepay extension and dropping a ransom note titled readme_safepay.txt.

This incident adds to SafePay’s growing list of high-profile attacks, including a recent breach of a North Carolina laboratory services provider, affecting hundreds of thousands of individuals. The group’s reach extends across multiple countries and sectors, employing advanced methods to ensure maximum impact. As Ingram Micro works to resolve the outage, the broader cybersecurity community continues to grapple with the evolving threat landscape posed by ransomware groups like SafePay.