This is a developing story, please check back for updates. In addition, Ingram Micro has set up a dedicated page for the latest information: https://www.ingrammicro.com/information.html and said they will continue to post updates there as they move forward.
UPDATE JULY 9: “Ingram Micro is pleased to report that we are now operational across all countries and regions where we transact business. Our teams continue to perform at a swift pace to serve and support our customers and vendor partners. We are grateful for the support we’ve received from our customers and industry colleagues. This is an industry based on strong and committed relationships that make all the difference.“
Four days after a ransomware attack crippled Ingram Micro’s ordering system on July 3, the distributor was unable to process orders from MSPs and solution providers. As of this writing, there was no word on when service will resume, causing uncertainty across the distributor’s supply chain.
Ingram Micro customers are clamoring for more information about when service will resume, but so far the company has done little more than acknowledge a ransomware attack and that mitigation is under way.
The meager communication is causing frustration. But don’t expect that to change, said Oli Thordarson, CEO of Alvaka Networks in Irvine, California, who has been involved with about 1,000 cybersecurity recoveries. Likely, the distributor has been instructed by legal counsel and cyber insurance companies to keep communications to a minimum, he explained.
“If you say something, and it later turns out to be different, it lives on forever,” said Thordarson. He called the distributor’s minimalistic notification a “very carefully thought-out response.”
MSPs Frustrated by Lack of Communication from the Distributor
But customers are running short on patience. “They have not communicated with us at all. [They’re] one of our top two vendors, [we’ve] done millions of dollars in business with them over the last 20-plus years. Zero communication,” said one MSP contacted by MSP Success who asked to remain anonymous.
The lack of communication was broached during the weekly The CyberCall webcast on Monday hosted by Andrew Morgan, founder of Right of Boom. If you’re an MSP, he said, “are you OK with the limited amount of information so far?”
“Not OK,” said Calvin Engen, chief technology officer at F12.net. MSPs are “left holding the bag,” wondering how long the interruption is going to last and where recovery stands. “I’m certainly of the camp that more communication is better, even if it is: ‘We’re still working on it,’” Engen said.
Chip Buck, chief technology officer of SaaS Alerts, said during the webcast that Ingram should update customers on what happened and whether the distributor is still negotiating with the attackers.
Lisa Shorr, co-owner of Secure Future Tech Solutions, an MSP in Warwick, Rhode Island, agreed. “It’s critical to acknowledge and share with all stakeholders right away, that if there is a situation, it is being investigated,” she said. “You don’t have to have all of the answers, but letting us know, enables us to take precautions on our end and have some response for our clients, should they see the news too.”
Morgan noted that SafePay, the group reportedly responsible for the ransomware attack on Ingram Micro, is responsible for more than 220 attacks so far.
Wide Repercussions Across the MSP Ecosystem
Ingram Micro is the world’s second largest distributor, with $48 billion in revenue, so the incident reverberates across the universe of MSPs and solution providers.
Brian Bean, executive vice president of product and technology services at Thrive, an MSP with 29 locations across the U.S., U.K., Canada, Australia, and Asia, said his company has been unable to place orders with Ingram Micro for days. Quoting his procurement officer, Bean said Thrive cannot track any pre-existing orders or place new orders, and doesn’t know if orders could be placed manually. The disruption also affected the process to add Adobe licenses through Ingram Micro, Bean said.
Shorr said her MSP was impacted as well. “We cannot make any software licenses or new hardware purchases,” she said. “This creates a client backlog and will need to push out installation dates.”
As for when service will be restored, it’s anyone’s guess. With no updates from the distributor, customers are left to speculate. Thordarson said not to expect service restoration until the end of the week. Based on his experience, it takes that long for a company of Ingram Micro’s size to restore all critical systems and take the necessary mitigation steps to restore “core functionality.”
What Ingram Micro Has Revealed So Far
Here is the distributor’s full statement about the incident, posted on Saturday:
Ingram Micro recently identified ransomware on certain of its internal systems. Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement.
Ingram Micro is working diligently to restore the affected systems so that it can process and ship orders, and the Company apologizes for any disruption this issue is causing its customers, vendor partners, and others.
Sources say Ingram Micro is working with the FBI and an external firm on the investigation, and restoration efforts are ongoing.
When MSP Success reached out to Ingram Micro for further comment, a spokesperson replied by email:” At this time, the press release issued serves as our statement regarding the incident.”
Update: Since that response, Ingram has contacted MSP Success with this information, dated July 7: “Today, we made important progress on restoring our transactional business. Subscription orders, including renewals and modifications, are available globally and are being processed centrally via Ingram Micro’s support organization. Additionally, we are now able to process orders received by phone or email from the UK, Germany, France, Italy, Spain, Brazil, India, China, Portugal and Nordics. Some limitations still exist with hardware and other technology orders, which will be clarified as orders are placed. To place subscription orders, customers should contact Unified Support. For general inquiries, customers should contact their sales representative.”
