# Ingram Micro SafePay ransomware takes down ordering systems for a week · pwn.watch

> SafePay ransomware hit IT distributor Ingram Micro around July 3, 2025, taking down its website, ordering systems, the Xvantage platform and Impulse licensing. Ingram Micro took systems offline and restored order processing globally by July 9-10.

Page: https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025 · generated 2026-10-22T23:52:53.443Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Ingram Micro (Xvantage, Impulse, ordering systems)
- Started: 2025-07-03 · closed: 2025-07-10
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025/feed.xml
- JSON Feed: https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025.json
- This file: https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025/llms.txt

## Updates (newest first)
- 2025-07-09: Order processing restored globally (https://www.ingrammicro.com/en-us/2025cybersecurityincident)
- 2025-07-05: Ingram Micro confirms ransomware on internal systems (8-K) (https://www.sec.gov/Archives/edgar/data/1897762/000162828025034372/ingm-20250705.htm)
- 2025-07-03: Outage begins across website and ordering systems (https://www.bleepingcomputer.com/news/security/ingram-micro-outage-caused-by-safepay-ransomware-attack/)

## Fix brief
# Security brief: Ingram Micro SafePay ransomware takes down ordering systems for a week

Source: https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025 · status: closed (closed Jul 10, 2025) · severity: high · updated Jul 10, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
SafePay ransomware hit IT distributor Ingram Micro around July 3, 2025, taking down its website, ordering systems, the Xvantage platform and Impulse licensing. Ingram Micro took systems offline and restored order processing globally by July 9-10.

Severity detail: Ransomware; global distributor outage

- Product: Ingram Micro (Xvantage, Impulse, ordering systems)

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Jul 9, 2025: Order processing restored globally
- Jul 5, 2025: Ingram Micro confirms ransomware on internal systems (8-K)
- Jul 3, 2025: Outage begins across website and ordering systems

## Advisories
- [Cybersecurity Incident](https://www.ingrammicro.com/en-us/2025cybersecurityincident) (Ingram Micro)
- [Ingram Micro Form 8-K](https://www.sec.gov/Archives/edgar/data/1897762/000162828025034372/ingm-20250705.htm) (SEC)

## Write-ups & news
- [Ingram Micro outage caused by SafePay ransomware attack](https://www.bleepingcomputer.com/news/security/ingram-micro-outage-caused-by-safepay-ransomware-attack/)
- [Ingram Micro says identified ransomware on certain of its internal systems](https://www.reuters.com/business/ingram-micro-says-identified-ransomware-certain-its-internal-systems-2025-07-06/)

---
Machine-readable: https://pwn.watch/i/ingram-micro-safepay-ransomware-july-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.