Ingram Micro is gradually getting back on its feet after a recent cyber attack severely disrupted systems.
In an update, the company said that it's been recovering systems and implementing new security protocols and processes in the wake of the incident.
The firm revealed it can now receive and process orders once again in most regions of the world, although in some countries there are still limitations when it comes to hardware and other technology orders.
"Ingram Micro is pleased to report that we are now operational across all countries and regions where we transact business. Our teams continue to perform at a swift pace to serve and support our customers and vendor partners," the company said in a statement.
"Our teams are now able to process and ship orders received via EDI, or electronically, as well as by phone or email across all of our business regions."
The latest regions to get back to normal are Austria, Canada, Singapore, and the Nordics, as well as the countries supported by its Miami Export business.
The company was already able to process orders for customers in Brazil, China, France, Germany, India, Italy, Portugal, Spain and the UK, albeit with limitations on hardware purchases.
As for subscription orders, the company said customers should contact Unified Support.
Since the attack, the company has been taking some systems offline and implementing other mitigation measures.
"Based on these measures and the assistance of third-party cybersecurity experts, we believe the unauthorized access to our systems in connection with the incident is contained and the affected systems remediated," it said.
"Our investigation into the scope of the incident and affected data is ongoing."
What happened with the Ingram Micro cyber attack?
Ingram Micro first revealed it had been hit by a cyber incident last week, with responsibility for the attack claimed by the SafePay ransomware group.
SafePay is believed to have breached the IT distributor via its GlobalProtect virtual private network (VPN) platform, according to reports.
The ransomware group is an up-and-coming outfit that’s been making waves in the industry for some time now. SafePay employs a ‘double extortion’ model, encrypting systems while exfiltrating sensitive data.
This technique is used largely to increase the attacker's leverage through the threat of public exposure and operational disruption.
Research from Halcyon found that SafePay has been using a modified version of LockBit's late-2022 code.
It uses a wide range of tactics, techniques, and procedures, including exploiting known vulnerabilities in widely used enterprise software to gain initial access. It then exploits legitimate remote management tools for persistence combined with credential-harvesting tools such as Mimikatz.
Halcyon’s investigation into SafePay noted that, despite its newcomer status in the ransomware scene, the group “demonstrates a surprising level of technical maturity and operational discipline”.
This, the company added, suggests it “may be run by experienced threat actors”.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Ransomware attacks carry huge financial impacts
- Developers face a torrent of malware threats as malicious open source packages surge 188%
- A major ransomware hosting provider just got hit US with sanctions
-
The UK government is working with Meta to create an AI engineering dream team to drive public sector adoptionNews The Open-Source AI Fellowship will allow engineers to apply for a 12-month “tour of duty” with the government to develop AI tools for the public sector.
-
SAS appoints Matt Parson as new chief revenue officerNews The former ExtraHop and Red Hat exec will spearhead SAS' global financial strategy as it targets further growth
-
M&S chair calls for mandatory reporting of cyber attacks after "traumatic" ransomware incident – but will it do more harm than good?News M&S chair Archie Norman has called for mandatory reporting amid claims two large UK companies were hacked without any public knowledge.
-
Arrests made in hunt for hackers behind cyber attacks on M&S and Co-opNews The suspects remain in custody for questioning by officers from the NCA's National Cyber Crime Unit
-
Ransomware attacks carry huge financial impacts – but CISO worries still aren’t stopping firms from paying outNews Increased anxiety over ransomware links directly to its devastating impact on business processes and one’s bottom line
-
‘The worst thing an employee could do’: Workers are covering up cyber attacks for fear of reprisal – here’s why that’s a huge problemNews More than one-third of office workers say they wouldn’t tell their cybersecurity team if they thought they had been the victim of a cyber attack.
-
Developers face a torrent of malware threats as malicious open source packages surge 188%News Researchers have identified more than 16,000 malicious open source packages across popular ecosystems
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'News The Hunters International ransomware group is rebranding and switching tactics
-
Using WinRAR? Update now to avoid falling victim to this file path flawNews WinRAR users have been urged to update after a patch was issued for a serious vulnerability.
-
A major ransomware hosting provider just got hit US with sanctionsNews Aeza Group's services were being used for ransomware, infostealers, and disinformation
