It was recently announced that Ingram Micro was pwned by SafePay ransomware group (who is killing it lately) on July 3rd, their systems are still down 5 days later.
Here are 5 things to know: https://www.crn.com/news/security/2025/5-things-to-know-on-the-safepay-ransomware-group
I find it interesting that root cause is leaked already, fingers pointing at Palo Alto’s VPN/PC security software, known as “GlobalProtect”. You have to wonder if Palo Alto’s competitors like Cisco & FortiGate leaked this info to the media. Or paid them. Or maybe it’s true.
Funny how ransomware seems to always hit companies during holidays, their infrastructure was encrypted and shut down on July 3rd. Enjoy your 4th of July weekend Ingram people! Maximize being a pain in the ass so CEO pays out 10 million in bitcoin to some wallet in Russia.
Here is the ransom notice their employees received on their computer machines (allegedly from Bleeping Computer). This is the last thing a security pro wants to ever see:
I looked up Ingram Micro security people on linkedin and they were all proud that a new security awareness intern started. If your network admins are making bad decisions, security awareness interns are probably not what your security program should be focusing on.
Ingram hasn’t done a good job communicating the attack. Here’s an article discussing how an org needs to communicate to their customers, stakeholders and other interested parties during an attack:
SafePay is powerful and moving quickly and extorting or costing US companies hundreds of millions of dollars. In May they successfully hacked 70 companies, 20% of all ransomware attacks.
At some point the US government needs to throw a few hundred billion at this ransomware problem and just stop it from happening. The money extorted is going to enemies of the US, it damages the US economy, and really needs to become a priority.
Leave a Reply
You must be logged in to post a comment.