Source: an ongoing outage at IT giant Ingram Micro is caused by a ransomware attack from SafePay, which has become one of the more active operations of 2025
Lawrence Abrams / BleepingComputer :
Context & Ripple Effects
The incident follows a 2025 pattern in which ransomware attacks have translated into prolonged operational disruption, including the attack that disrupted UK retailer M&S. It also fits a longer record of attacks reaching major technology and services organizations, such as LockBit's theft of data from Infosys McCamish Systems.
SafePay's reported activity makes the Ingram Micro outage more than an isolated availability event: it is a current example of an active ransomware operation interrupting a large IT-sector company.
First-order effects
- Ingram Micro must manage an ongoing service outage and incident response while the reported SafePay attribution puts the group at the center of the attack investigation.
- Customers and partners dependent on affected Ingram Micro systems may face immediate disruption until the outage is contained and services are restored.
Second-order effects
- The incident raises the operational stakes for organizations connected to large IT intermediaries, encouraging scrutiny of outage contingencies and third-party access paths.
- SafePay's visibility may increase pressure on defenders and service providers to prioritize detection and recovery against active ransomware operations rather than treating disruption as a one-off IT failure.
Third-order effects
- If attacks on major IT providers continue, cyber resilience will increasingly be judged by recovery and dependency management across partner networks, not only by an individual company's perimeter defenses.
- The pattern could further concentrate attention on ransomware groups' ability to disrupt shared technology infrastructure even as individual operations evolve or disappear, as seen when Conti took its infrastructure offline and leaders moved to smaller groups.
The trend: Ransomware is increasingly targeting organizations whose outages can propagate operational disruption across interconnected business and technology ecosystems.