Loading story…
Ingram Micro disclosed that a July 2025 ransomware attack resulted in the theft of files from internal repositories and a subsequent data breach affecting ~42,000 people (reported as 42,521 in filings). The company said an unauthorized party accessed and exfiltrated certain files between July 2–3, 2025, and that it detected the incident on July 3, after which it took systems offline and began containment and remediation with external cybersecurity experts and law enforcement notification.
The compromised data primarily involved employee and job applicant records, including names, contact details, dates of birth, and government-issued identification numbers such as Social Security, driver’s license, and passport numbers, as well as some employment-related information (e.g., work-related evaluations). The incident also caused significant operational disruption, including outages impacting internal systems and customer-facing operations; reporting noted that SafePay claimed responsibility and alleged theft of ~3.5 TB of data, though Ingram Micro has not publicly attributed the intrusion to a specific threat group while confirming ransomware was deployed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In January 2026, Ingram Micro disclosed in a filing with the Maine attorney general that the July 2025 ransomware attack exposed personal data belonging to 42,521 people, including employees and job applicants. The company said the compromised information included identifiers such as names, dates of birth, Social Security numbers, other government ID numbers, and employment-related records, and it offered two years of credit monitoring and identity protection.
After the ransom deadline passed, SafePay claimed it had published the stolen data on its Tor leak site, indicating negotiations had failed. One report said the download link provided by the group did not work.
SafePay set a July 31, 2025 deadline for ransom payment in connection with the attack. The group used the deadline as part of its double-extortion pressure campaign against Ingram Micro.
After the incident became public, the SafePay ransomware group claimed responsibility on its leak site and said it had stolen 3.5 TB of data from Ingram Micro. The claim aligned with reports that ransomware had been deployed, though Ingram Micro did not publicly attribute the attack to a specific group.
Within about a week of the attack, Ingram Micro restored affected systems and resumed global operations. Reporting says recovery was largely complete by July 9, 2025, after logistics and service management had been disrupted for roughly a week.
On July 3, 2025, Ingram Micro detected the ransomware incident, engaged external cybersecurity experts, notified law enforcement, and shut down some systems to contain and remediate the attack. The outage disrupted internal systems, the website, and operations, with some employees told to work from home or sent home.
An unauthorized third party began exfiltrating files from Ingram Micro's internal repositories on July 2, 2025. The stolen data later proved to include employee and job applicant records containing sensitive personal information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
San Jose officials notified current and former city employees that a **USB drive was lost** on Jan. 9 and may have contained sensitive employee data, including **Social Security numbers**; the city has not disclosed how many individuals were affected. Separately, **Conduent Business Services** reported a large-scale compromise in which attackers allegedly accessed its network from **Oct. 21, 2024 to Jan. 13, 2025** and exfiltrated files containing personal and medical data; multiple state-level notices and alerts cited impacts ranging from **10.5 million** individuals (Oregon DOJ alert) to **4 million** residents (Texas), with Conduent stating it has not seen evidence of misuse or public posting to date. In another incident, **Managed Care Advisors / Sedgwick Government Solutions** disclosed a ransomware event affecting a corporate **SFTP server** that stored **PII/PHI**; the company said the intrusion began **Nov. 16, 2025** via exploitation of a vulnerability in the SFTP application, was detected **Dec. 4, 2025**, and resulted in encryption of files on that server only. Sedgwick reported it disabled SFTP connections, restored data from backups the next day, and engaged **Mandiant** for forensic support, stating the investigation found no compromise beyond the single server.
Jul 12, 2026
Medical Computer Business Services (MCBS), a Georgia-based medical billing and practice-management firm, disclosed that a September 2025 network intrusion exposed the personal, insurance, and medical information of **1,261,464 individuals**. The company said unauthorized actors accessed its systems between **September 22 and September 26, 2025**, and that the compromised data may include names, addresses, Social Security numbers, dates of birth, insurance identifiers, medical histories, diagnoses, and treatment details. MCBS reported that the affected records were tied to data it managed for **seven healthcare organizations**. The incident has been linked to the **PEAR ransomware** group, which claimed responsibility shortly after the intrusion and alleged it stole more than **3 TB** of data, including patient `PII`/`PHI`, financial records, HR documents, payment information, and emails. MCBS said its investigation concluded on **May 28, 2026**, while U.S. Department of Health and Human Services breach-tracker data lists the event among major healthcare breaches, underscoring the scale of the exposure and the risk to patients and partner providers.
Jul 30, 2026