IT giant Ingram Micro is notifying roughly 42,000 people that their personal information was compromised in a ransomware attack.
The incident occurred on July 3, 2025, and forced the IT products and services distributor to take certain systems offline to contain the attack, which resulted in widespread outages across its services.
Ingram Micro was able to restore the affected systems roughly a week later, resuming operations across all countries and regions by July 9.
During the attack, hackers accessed certain company systems containing employment and job applicant records, the company now says in notification letters sent to potentially affected individuals.
“Based on our investigation, we determined that an unauthorized third party took certain files from some of our internal file repositories between July 2 and 3, 2025,” Ingram Micro says.
The compromised information includes names, dates of birth, Social Security numbers, passport numbers, driver’s license numbers, other government-issued identification numbers, and employment-related data.
Ingram Micro notified the Maine Attorney General’s Office that 42,521 people were impacted by the incident.
The company is providing the potentially affected individuals with 24 months of free credit monitoring and identity protection services.
While Ingram Micro did not name the ransomware gang responsible for the attack, the Safepay group listed the company on its Tor-based leak site in July, claiming the theft of 3.5 terabytes of data.
Safepay made the allegedly stolen data publicly available in early August, which suggests that Ingram Micro did not pay a ransom.
Related: 750,000 Impacted by Data Breach at Canadian Investment Watchdog
Related: Central Maine Healthcare Data Breach Impacts 145,000 Individuals
