Update 7/6/25: Added Ingram Micro’s confirmation it suffered a ransomware attack below. Also updated ransom note with clearer version.

An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned.

Ingram Micro is one of the world’s largest business-to-business technology distributors and service providers, offering a range of solutions including hardware, software, cloud services, logistics, and training to resellers and managed service providers worldwide.

Since Thursday, Ingram Micro’s website and online ordering systems have been down, with the company not disclosing the cause of the issues.

BleepingComputer has now learned that the outages are caused by a cyberattack that occurred early Thursday morning, with employees suddenly finding ransom notes created on their devices.

The ransom note, seen by BleepingComputer, is associated with the SafePay ransomware operation, which has become one of the more active operations in 2025. It is unclear if devices were actually encrypted in the attack.

It should be noted that while the ransom note claims to have stolen a wide variety of information, this is generic language used in all SafePay ransom notes and may not be true for the Ingram Micro attack.

Do you have information about this or another cyberattack? If you want to share the information, you can contact us securely and confidentially on Signal at LawrenceA.11, via email at lawrence.abrams@bleepingcomputer.com, or by using our tips form.

Sources have told BleepingComputer that it is believed the threat actors breached Ingram Micro through its GlobalProtect VPN platform.

Once the attack was discovered, employees in some locations were told to work from home. The company also shut down internal systems, telling employees not to use the company’s GlobalProtect VPN access, which was said to be impacted by the IT outage.

Systems that are impacted in many locations include the company’s AI-powered Xvantage distribution platform and the Impulse license provisioning platform. However, BleepingComputer was told that other internal services, such as Microsoft 365, Teams, and SharePoint, continue to operate as usual.

As of yesterday, Ingram Micro has not disclosed the attack publicly or to its employees, only stating there are ongoing IT issues, as indicated by company-wide advisories shared with BleepingComputer.

The SafePay ransomware gang is a relatively new operation that was first seen in November 2024, accumulating over 220 victims since then.

The ransomware operation has been previously observed breaching corporate networks through VPN gateways using compromised credentials and password spray attacks.

BleepingComputer contacted Ingram Micro yesterday and today about the outages and ransomware attack, but did not receive a response to our emails.

Update 7/6/25: In a brief Sunday morning announcement, Ingram Micro has confirmed that they suffered a ransomware attack.

“Ingram Micro recently identified ransomware on certain of its internal systems,” reads Ingram Micro’s statement.

“Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement.”

“Ingram Micro is working diligently to restore the affected systems so that it can process and ship orders, and the Company apologizes for any disruption this issue is causing its customers, vendor partners, and others.”

Prosecutors have handed out prison time for eight individuals involved in a wide-ranging conspiracy of wire, bank and mail fraud.

In a press release, the US Attorney’s Office for the Middle District of Alabama says that Hunter Hudson, Jr., and seven other people have been sentenced to prison in an elaborate bank fraud scheme that caused an intended loss amount of more than $1.5 million.

The group, which referred to itself in a group chat as the “Fraud Academy,” stole checks, altered them and then deposited them into fraudulent bank accounts, according to prosecutors.

The US Postal Service aided in the investigation, according to the press release.

Says Timothy J. O’Malley, Acting Special Agent in Charge with the Federal Bureau of Investigation (FBI),

“Any attempt to exploit our postal or banking systems is a serious violation of the public’s trust. These actions will not be tolerated and will be prosecuted to the fullest extent of the law. Protecting the integrity of our postal and financial systems is essential and non-negotiable.”

25-year-old Hunter Hudson, the ringleader of the operation, was arrested in May of last year. Local news outlet Fox 13 reported that his rap lyrics gave the investigators material for their probe.

Captain Eric Hill with the Venice Police Department in Florida said that Hudson “drove around throughout the whole region of the United States and he would steal mail.”

“He would wash those checks or use the account information on those checks to then make fraudulent deposits into other individuals’ accounts who would agree to be part of this scam with them.”

Hudson was sentenced to 92 months in prison and was ordered to pay $987,883.50 in restitution and to forfeit $91,020.41.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Bitcoin continues to trade lower for April, surrendering the majority of its Q1 gains as global markets react to escalating US-China trade tensions.

The move, tied to the US trade war, comes amid broader asset repricing, with Treasury yields falling, oil collapsing, and equities entering correction territory.

The above post-tariff chart captures the acute market response since President Trump’s April 2 announcement of sweeping trade penalties and China’s response of an 84% tariff on US goods, a move Beijing described as non-negotiable.

Within days, oil prices collapsed by 20.92%, while SPY fell 10.23% and Bitcoin dropped 7.34%. Bond prices also declined, with US10 and CN10 down 2.42% and 2.58%, respectively, reflecting upward pressure on yields.

Gold, often a traditional safe haven, retreated 2.83%, indicating that liquidity stress and risk-off sentiment dominated across asset classes.

Bitcoin’s relative positioning, down less than SPY and oil but more than bonds and gold, shows that despite strategic reserve narratives, it remains partially tethered to broader macro volatility under acute market stress.

Their overall performance since Donald Trump’s election win solidifies Bitcoin’s relative resilience.

Since the November 2024 US election, Bitcoin is up 11.51 %, and gold is closely trailing at 11.09 percent. Both assets have held ground as traditional markets repriced sharply. SPY has declined 14.42%, and oil prices have collapsed by over 20%, highlighting widespread macro stress.

Meanwhile, the US and Chinese 10-year bond prices (US10 and CN10) have fallen 5.11% and 1.72%, respectively, consistent with expectations of persistent inflation or heightened issuance.

BTC correlation with macro deepens

Bitcoin’s performance since Trump’s inauguration initially tracked with a supportive policy environment.

Public backing of crypto adoption, tokenization of reserves, and re-shoring initiatives contributed to a bullish narrative across digital assets.

However, the latest data shows Bitcoin trading mostly in line with risk assets rather than decoupling from them.

The recent selloff across SPY and the reversal in Treasury yields reflect shifting expectations. Markets are beginning to price in slower growth, tighter consumption, and more defensive positioning. Yale’s Budget Lab projects a 0.9 percentage point decline in real GDP for 2025, with the average household expected to incur $3,800 in additional costs from the tariff regime.

Despite favorable long-term policy framing, Bitcoin has not escaped volatility tied to global liquidity and demand concerns. Institutional allocators appear to be reducing exposure to beta-sensitive assets, crypto included, as recession odds rise.

JPMorgan now places the probability of a global recession at 60%, up from 40% before the April announcements. Goldman Sachs raised its US-specific projection to 45 percent. JPMorgan’s annual letter also cautioned that prolonged tariffs may contribute to persistent inflation, asset volatility, and reduced investment confidence.

Global bond divergence narrows Bitcoin’s safe-haven window

While US Treasury yields have reversed sharply, China’s sovereign bond market is reflecting different stress signals. The China 10-year yield is down to 1.65 percent, dropping 65 basis points year over year.

Trading Economics data also shows consistent yield declines across the 2Y, 5Y, and 30Y curves. These moves imply deflationary pressure, weak external demand, and limited domestic growth rebound potential.

As Citi reported, China’s GDP forecast has been cut from 4.7 percent to 4.2 percent for 2025. However, this is still considerably higher than the US’s current 2.4% growth and projected 3% decline. Kaiyuan Securities projects that US tariffs may reduce Chinese exports by nearly a third, reducing total exports by 4.5 percent and dragging growth by over a percentage point.

Yet,

With both Western and Chinese sovereign curves pricing in downside growth risk, Bitcoin’s role as a global reserve hedge becomes more complicated.

Institutional portfolios may hold back on discretionary allocation until liquidity stabilizes or policy clarity returns.

Trump’s framing of Bitcoin as a reserve-grade digital commodity continues to resonate with parts of the domestic crypto ecosystem, but implementation remains unclear. For now, investors appear to be watching macro signals more than political signaling.

Bitcoin outlook in context of recession risk

The structural narrative surrounding Bitcoin as a geopolitical hedge, inflation buffer, or programmable reserve asset remains intact.

However, in periods of macro stress, correlations tend to increase across all risk markets. The latest price action indicates that Bitcoin is not yet viewed as a risk-off asset under liquidity duress.

BTC may still find policy tailwinds if the administration accelerates Bitcoin-native initiatives, introduces digital treasury issuance, or formalizes sovereign Bitcoin holdings. Until then, market participants are trading the asset through a macro lens. Price behavior remains closely tied to risk conditions, recession modeling, and cross-asset liquidity.

Brent crude oil has fallen more than 20 percent since late March, with forward spreads narrowing and surplus pricing increasing. Consumer retrenchment, reduced export demand, and pressure on manufacturing margins all feed into broader market repricing.

Bitcoin, as part of the broader allocation spectrum, remains sensitive to these shifts.

Year-to-date Bitcoin is actually one of the worst-performing assets, second only to oil.

The divergence illustrates how Bitcoin and gold have so far absorbed trade war volatility more effectively than oil, equities, or sovereign debt markets, suggesting that Bitcoin has drawn relative strength even as global liquidity deteriorates.

However, no asset can compare to gold in 2025, up 16%.

Mentioned in this article

Newspaper publishing giant Lee Enterprises has confirmed that a ransomware attack is behind ongoing disruptions impacting the group’s operations for over two weeks.

As a local news provider and one of the largest newspaper groups in the United States, Lee publishes 77 daily newspapers and 350 weekly and specialty publications across 26 states. Its newspapers have a daily circulation of over 1.2 million, and digital editions reach more than 44 million unique visitors.

In a Friday filing with the U.S. Securities and Exchange Commission (SEC), the media giant said the attack triggered a systems outage on February 3. “Preliminary investigations indicate that threat actors unlawfully accessed the Company’s network, encrypted critical applications, and exfiltrated certain files,” Lee said.

“The incident impacted the Company’s operations, including distribution of products, billing, collections, and vendor payments. Distribution of print publications across our portfolio of products experienced delays, and online operations were partially limited.

“As of February 12, 2025, all core products are being distributed in the normal cadence, however weekly and ancillary products have not been restored. These products represent five-percent of the Company’s total operating revenue. The Company anticipates a phased recovery over the next several weeks.”

Lee is now investigating if the sensitive data or personally identifiable information (PII) was also exposed during the breach, but no conclusive evidence has been found.

In response to the ongoing outage, Lee has also implemented temporary measures, such as manual transaction processing and alternative distribution channels, to maintain critical business functions while encrypted systems are restored.

The company first disclosed the breach in a 10-Q quarterly report filed with the SEC on February 7, four days after the ransomware attack was discovered.

Lee newsrooms across the United States have reported that the cyberattack forced the newspaper publisher to shut down many of its networks, leading to widespread printing and delivery disruptions for dozens of newspapers.

BleepingComputer also learned that the resulting outage caused chaos across the newspaper group, with reporters and editors unable to access their files because VPNs used to connect securely to the network stopped working.

Five years ago, before the 2020 U.S. presidential election, the newspaper group was hit by another cyberattack when Iranian hackers breached its network as part of a broader campaign to spread disinformation.