Safepay ransomware group lists ingrammicro.com on its leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Technology
• Announcement date: July 29, 2025

The Safepay ransomware group has listed the technology organization ingrammicro.com on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully compromised the organization's data, alleging that a significant volume of information has been exfiltrated during the attack.

Details of the Safepay claim

The threat actor known as Safepay added ingrammicro.com to its leak site on July 29, 2025. In the announcement, the group claims to have compromised the organization's data and has subsequently initiated a countdown timer on their platform. This tactic is a common feature of modern ransomware operations, used to pressure victims by creating a sense of urgency regarding the public release of stolen information.

The announcement makes a specific reference to the organization's financial standing, noting its $48.9 billion in revenue. This detail is often used by ransomware groups to highlight the potential impact of the breach and to increase the pressure on the target to meet ransom demands. While the group has initiated this countdown, no specific details regarding the nature of the exfiltrated data have been provided, other than the mention of the total volume of the dataset.

Data involved in the alleged breach

Regarding the information allegedly stolen during the incident, the group has not provided specific details concerning the types of files or the nature of the data contained within the breach. The only information provided by the threat actor is the total size of the claimed exfiltration.

• The group claims to have acquired a dataset totaling 3.5 TB.

The listing does not name any specific data types or individual files that have been compromised.

About Ingram Micro

Ingram Micro is a global technology company that provides technology product distribution, supply chain solutions, and cloud computing services. The company offers a broad portfolio of hardware, software, and lifecycle services to its global client base.

Analysis and industry implications

The Safepay group is known to operate using a double-extortion model and emerged in late 2024. In a double-extortion scheme, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to leak it publicly if a ransom is not paid. The group's claim of not utilizing an affiliate program may suggest that their attacks are conducted under a centralized management structure.

The size of the dataset mentioned in the claim suggests that a broad compromise of corporate operations or customer information may have occurred. Given the organization's US-based operations, a confirmed breach could trigger investigations under state-level data privacy laws and relevant regulatory bodies. Secondary risks associated with such a large-scale leak include the potential use of leaked data for identity theft or targeted phishing campaigns against the organization or its partners.

For organizations operating within the technology and supply chain sectors, such incidents highlight the necessity of robust defensive postures. Common defensive steps include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and ensuring that data encryption is applied both at rest and in transit. Furthermore, maintaining a rapid incident response plan is critical for managing the legal and regulatory complexities that arise following a potential data breach.