Breachesby GlyphIngram Micro
Disclosed Jul 5, 202542,521 affectedConfirmed
SafePay ransomware attack shuts down Ingram Micro, exposes 42,000 people
Ingram Micro said a ransomware attack that began July 3, 2025 caused a global outage of its ordering and licensing systems; the SafePay gang claimed it and threatened to leak 3.5TB of data. Ingram Micro later told Maine's attorney general that files with employee and job applicant data, including SSNs and ID numbers, of over 42,000 people were taken.
What is known
| People affected | 42,521 (as reported by the organization) |
|---|---|
| Disclosed | Jul 5, 2025 |
| Discovered | Jul 3, 2025 |
| Happened | Jul 2, 2025 |
| Attack | Ransomware |
| Data exposed | Internal documentsNamesDates of birthSocial Security numbersGovernment IDsEmploymentHealthInsuranceAddresses |
| Sector | Tech · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: Ingram MicroIngram Micro says ongoing outage caused by ransomware attackIngram Micro says ransomware attack affected 42,000 peopleSafePay ransomware threatens to leak 3.5TB of Ingram Micro dataIngram Micro cybersecurity press release (8-K exhibit)Texas Attorney General data security breach report BR-0004789: Ingram MicroVermont Attorney General: 2026-01-16 Ingram Micro Data Breach Notice to ConsumersIndiana Attorney General 2026 data breach report: Ingram Micro
Notices filed
History of this record
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdfby backfillSource
empty to https://ago.vermont.gov/document/2026-01-16-ingram-micro-data-breach-notice-consumersby backfillSource
["internal-docs","names","dob","ssn","government-id","employment"] to ["internal-docs","names","dob","ssn","government-id","employment","health","insurance","addresses"]by backfillSource
42000 to 42521by backfillSource
other to techby seedSource
unknown to ransomwareby seedSource
[] to ["internal-docs","names","dob","ssn","government-id","employment"]by seedSource
empty to organizationby seedSource
empty to 42000by seedSource
2026-01-16 to 2025-07-05by seedSource
empty to 2025-07-03by seedSource
empty to Ingram Micro said a ransomware attack that began July 3, 2025 caused a global outage of its ordering and licensing systems; the SafePay gang claimed it and threatened to leak 3.5TB of data. Ingram Micro later told Maine's attorney general tby seedSource
empty to SafePay ransomware attack shuts down Ingram Micro, exposes 42,000 peopleby seedSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.