Ingram Micro ransomware attack: July 2025 outage, stolen HR files, and letters to 42,521 people

What happened in the Ingram Micro ransomware attack?

Ingram Micro, which calls itself a technology company for the global IT sales channel, went public with the attack on Saturday, July 5, 2025. Its press release said it had identified ransomware on some internal systems, taken certain systems offline and brought in cybersecurity experts, and that it had notified law enforcement. The company said it was working to restore the systems so that it could process and ship orders again. It filed the release with the SEC on July 7 under Item 8.01, the "other events" item, rather than Item 1.05, the item for incidents a company has judged material.

The guide to Item 8.01 and Item 1.05 explains how companies use the two items. Ingram Micro's own later account is consistent with it. In its annual report it said the attack did not cause a material interruption of its operations or materially harm its business, financial condition or reputation. It restored the affected systems from backups.

Date	What happened	Source
July 2 to 3, 2025	Files taken from internal file repositories; breach dates in California's record	Letter; California record
July 3, 2025	Ingram Micro detects the incident	Letter
July 5, 2025	Press release: ransomware on internal systems	Press release
July 7, 2025	Form 8-K, Item 8.01	SEC EDGAR
August 6, 2025	Second-quarter results: no impact on the June quarter	Earnings release
January 16, 2026	Letters dated and sent; Indiana's notice date	Letter; Indiana record
January 17 and 21, 2026	Massachusetts and Texas log the notice	Massachusetts and Texas records
March 3, 2026	10-K reports the response costs	Form 10-K

The letters went out 197 days after detection. California's record lists the breach as July 2 and July 3, 2025. The notice-delay guide compares gaps like this across the log.

What information was stolen in the Ingram Micro breach?

The stolen files were HR files. The letter says they include employment and job applicant records, with name, contact information, date of birth, and government ID numbers such as Social Security, driver's license and passport numbers. They also include health information found in employment records, such as medical or health insurance details, and employment information such as work evaluations. What was in the files varied from person to person.

Texas's record lists name, address, Social Security number, driver's license number, government-issued ID number, medical information, health insurance information, date of birth and "other". Massachusetts marks Social Security numbers, medical records and driver's licenses for its 139 residents.

How many people were affected by the Ingram Micro breach?

Indiana's record gives the total: 42,521 people. The state counts are 4,136 in Indiana, 3,079 in Texas and 139 in Massachusetts. Indiana's is the largest of the three state counts, nearly one in ten of the total. The SEC filings used for this entry give no count of people.

What did the attack cost Ingram Micro?

The 10-K for fiscal 2025 puts a number on it. Corporate expenses for the year included $6,168 thousand (about $6.2 million) of costs for outside services and other expenses in response to the July 2025 ransomware incident. The 10-K lists the kinds of cost: investigation, remediation, system restoration and improvements to its cybersecurity program. In August 2025, the chief executive said the attack early in July had no impact on the company's June-quarter results. The cost table in the after-the-8-K guide sets figures like this one beside other companies' filings.

What is Ingram Micro offering, and was my information involved?

The letter offers two years of free credit monitoring and identity protection through Experian IdentityWorks. Questions go to 833-931-5455, Monday to Friday, 8 a.m. to 8 p.m. Central time, quoting the engagement number in the letter. The sample letter filed in California says enrollment closed on April 30, 2026, so the code in a January letter may no longer work. The guide to credit monitoring offers covers what to do when an offer has lapsed.

If you worked at Ingram Micro or applied for a job there, and you got a letter dated January 16, 2026, your records were in the stolen files. Customers and vendors are not the group the letter describes: it speaks of employment and applicant records only. If you think you should have had a letter and did not, the number above is the company's channel.

What the filings leave open

• How the attackers got in, and which group was behind the attack.
• Whether Ingram Micro paid a ransom.
• Whether any customer or partner data was in the stolen files; the letter covers only HR records.
• How the 42,521 total splits between employees and job applicants.