INSIGHTS
Ingram Micro: six days down for a distributor and its customers
On 3 July 2025 ransomware stopped ordering and licence provisioning at Ingram Micro, one of the largest technology distributors, for about six days. The analysis: dependent business interruption for resellers and managed service providers, waiting periods, aggregation in the IT channel and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, July 2025 · by cybercoverinsurance
On 3 July 2025, at the start of the US Independence Day holiday weekend, ransomware hit Ingram Micro, one of the world's largest technology distributors for businesses. The website and the ordering and licence provisioning platforms stopped for several days. On 9 July the company said it was operational again in all countries. Months later it notified more than 42,000 people of the theft of personal data.
The case is useful for cyber underwriters because of what does not show in Ingram's accounts: the thousands of resellers, integrators and managed service providers that for a few days could neither order hardware nor activate licences. It is an example of short, widespread dependent business interruption, and of how policy terms decide whether it becomes a claim.
What is known
The attack. According to BleepingComputer, the attack began on Thursday 3 July. The website and online ordering systems went offline, along with the Xvantage distribution platform and the Impulse licence provisioning platform. A ransom note from the SafePay group was found on company devices. Sources believe the attackers got in through the GlobalProtect VPN, probably with compromised credentials. Palo Alto Networks said none of its products was the source of the vulnerability (BleepingComputer).
Confirmation and recovery. Ingram first spoke of an "IT disruption" and confirmed ransomware only two days later, under pressure from partners and reporters (Channel Insider). On 8 July it was taking orders by phone and email in several countries. On 9 July it said it was operational in all countries and regions. On 29 July SafePay added Ingram to its leak site, threatening to release 3.5 TB of data (The Register).
The accounts. In its second quarter results CEO Paul Bay said the attack had no impact on the quarter ended in June. The CFO spoke of an effect still being quantified for the days without transactions, softened by the timing over the holiday. Third quarter guidance allowed for a potential loss of business. Bay confirmed that some data had been exfiltrated (IT Channel Oxygen).
Notifications. In January 2026 filings with the Maine Attorney General came to light: 42,521 people, with names, dates of birth, Social Security numbers, passports, driving licences and employment-related information. The attackers had accessed some internal file repositories on 2 and 3 July (TechInformed).
What is not known. Ingram has not disclosed the incident's costs, any ransom demand or payment, or the number of customers left without service. There is no public data on resellers' losses.
The distributor's outage is the customers' outage
Six days for Ingram, six days for everyone. A distributor sits between manufacturers and thousands of resellers. When its platforms stop, those selling hardware and software to businesses receive no goods and activate no licences. For Ingram's customers the loss is dependent business interruption, with no breach of their own systems.
Licences matter as much as goods. The Impulse platform is used to activate software subscriptions. For a managed service provider, being unable to activate or renew licences for its clients means service contracts not met. The loss can turn into liability towards end customers.
The waiting period decides. Dependent business interruption covers usually start after a waiting period expressed in hours, and only for IT service providers or named suppliers. A technology distributor does not always fall within the definition of IT service provider. An outage of a few days can stay below the threshold for many customers and go above it for others.
A short, widespread outage
Many small losses, few claims. Most resellers probably lost sales or simply postponed them. It is the kind of event that produces many small losses, many questions to brokers and few paid claims. For underwriters, it is still a test of policy definitions: clear ones avoid disputes across thousands of files.
The calendar helped. The CFO attributed the limited impact partly to the attack falling on a holiday and early in the month and quarter (IT Channel Oxygen). The same outage at quarter end, when resellers close orders, would have weighed more.
Aggregation sits in the channel. A few large distributors serve much of the IT market. A portfolio of small technology companies, resellers and managed service providers often depends on the same two or three distributors. The data is rarely collected.
The VPN and staff data
The VPN remains a way in. According to sources, entry went through a VPN with compromised credentials. SafePay, according to BleepingComputer, is known for getting in through VPNs with stolen credentials or password spraying. Multi-factor authentication on remote access is the most requested control in questionnaires, and the case confirms why.
The stolen data is mostly about staff. The notified information includes employment-related data and identity documents (TechInformed). For a company selling to other companies, the breach of employee and applicant data is the part that generates notifications, even if the main loss is the interruption.
What to bring to renewals
Impact for insurersMedium
Ransomware at a large technology distributor stopped ordering and licence provisioning for thousands of customers for about six days, with widespread but short dependent losses.
On the portfolio side, the useful question is how many IT channel insureds depend on the same distributor. A one-week outage at the wrong point in the quarter, at one of the few large distributors, is an aggregation scenario that is simple to build and useful for testing dependent business interruption definitions.