Ingram Micro Global Technology Distributor Breach (2025): 23.5 Million Records Including SSN & Home Address Exposed via Ransomware

About Ingram Micro

Ingram Micro is one of the world's largest technology distributors, connecting hardware manufacturers, software publishers, and cloud service providers with resellers, managed service providers, and enterprise customers globally. The company is publicly traded on the NYSE under the ticker INGM and serves markets in over 60 countries. Its AI-powered commerce platform, Xvantage, underpins much of its digital transaction processing. Ingram operates at a scale where disruption to its systems can cascade across the broader technology supply chain.

Why They Hold Your Data

Technology distribution networks collect customer, vendor, reseller, procurement, logistics, and account records across large-scale IT supply-chain operations.

Recent Developments

Ingram Micro completed an IPO on the NYSE in October 2024, returning to public markets after a period of private ownership. The company has positioned Xvantage as a core strategic differentiator, enabling automated procurement and licensing transactions at scale. It has continued expanding distribution partnerships and services capabilities globally. The July 2025 ransomware attack was the defining operational event of its first year as a public company.

Data Points Exposed

Breach Impact

On July 5, 2025, Ingram Micro announced it had identified ransomware on certain internal systems and proactively took affected systems offline to contain the threat. The company engaged third-party cybersecurity experts, notified law enforcement, and issued regular public updates on a dedicated status page. The SafePay ransomware group was identified as responsible, with initial access reportedly gained through Ingram's GlobalProtect VPN using stolen credentials. Systems were down for approximately one week. Ingram Micro achieved full global operational recovery within a week. SafePay subsequently threatened to leak 3.5TB of allegedly stolen data, escalating extortion pressure after system restoration was complete. Formal breach notifications were filed reporting impact to more than 42,000 individuals, with exposed data including Social Security numbers and government-issued identification. Analysts estimated the operational disruption cost the company as much as $136 million in daily revenue during the outage window.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).