On July 5th, 2025, the news broke: Ingram Micro, one of the world’s largest IT distributors, was hit by a ransomware attack attributed to the SafePay group. Within hours, their ordering systems, cloud platforms, license provisioning, and customer portals were all rendered inoperable. What’s most striking isn’t just the size of the target, but how profoundly it has impacted Managed Service Providers (MSPs) worldwide.

This event is more than another ransomware headline. It exposes the deep structural fragility that exists in the MSP supply chain, and how even the most robust service providers can be brought to their knees when a key upstream partner goes dark.

The Ripple Effect: When One Link Fails, the Chain Snaps

Ingram Micro isn’t just a distributor. It’s a critical backbone for tens of thousands of MSPs. Their Xvantage platform, cloud service ordering tools, and license management interfaces are woven into the daily fabric of MSP operations.

So when SafePay reportedly exploited vulnerabilities in Ingram’s VPN setup (specifically, GlobalProtect from Palo Alto Networks), and ransomware began encrypting core systems, the impact was immediate and global:

• MSPs couldn’t place hardware orders
• Licenses couldn’t be provisioned or renewed
• Cloud subscriptions were in limbo
• Support teams were left in the dark

And the worst part? No one could get a clear update. For several days, even basic communication from Ingram was limited, leaving MSPs guessing, firefighting, and fielding tough questions from their own clients.

This wasn’t just a supplier having a bad day, this was business interruption at scale.

The Hidden Dependency Few Talk About

MSPs have spent years hardening their infrastructure—investing in cybersecurity training, patch management, MFA, SIEM platforms, and threat detection. But as the Ingram incident shows, many haven’t extended that same scrutiny to their supply chain risk.

In fact, most MSPs operate with an unspoken assumption:

“If we trust our vendors, we’ll be fine.”

That assumption is dangerous.

When your distributor is a single point of failure for licensing, billing, and hardware, you don’t own your business continuity plan. You’re outsourcing your stability to a third party, and you may not even realise it until things go wrong.

Reddit, Forums, and the MSP Reality Check

In the hours and days following the Ingram outage, MSPs took to Reddit, Discord, and private forums. The mood ranged from frustrated to panicked:

• “We can’t order anything. Our client needs a new machine and we’re stuck.”
• “No ETA from Ingram. How are we supposed to meet SLAs when our distributor can’t provision?”
• “Our PSA has 15 tickets all blocked waiting on licensing issues.”

Many asked the same questions:

• Why isn’t there a backup portal?
• Why don’t they have a secondary communications channel?
• What’s their DR plan—and do we ever get to see it?

These are questions MSPs themselves would expect their own clients to ask them. Yet the tables were turned.

What This Means for the Future of MSP Resilience

This incident isn’t a fluke. It’s a warning sign. And it’s not about Ingram specifically, it could’ve been any vendor, any distributor, any SaaS platform.

The truth is: MSPs need to reimagine what resilience really means in 2025 and beyond.

1. Single Supplier Dependency Must End

If all your Microsoft licenses, cloud subscriptions, or procurement workflows are tied to a single distributor or platform, your risk exposure is massive. Dual-distributor setups—or at least a process for emergency procurement via alternates—should be standard.

Even if your margins are slightly reduced, the insurance of continuity is worth the cost.

2. Vendor BCM and Security Due Diligence is Essential

Most MSPs ask clients to trust their vendors. But how many regularly assess the business continuity or ransomware response capabilities of their own key partners?

• Do you know your distributor’s RTO/RPO?
• Have they shared their cybersecurity policy?
• Can you access a sandboxed portal if their primary systems go offline?

If not, those are conversations that need to happen—before the next breach hits.

3. SLAs Should Flow Upstream, Not Just Down

It’s common for MSPs to offer SLAs to their clients. But how many vendors or distributors are held to similar standards?

Where possible, build vendor contracts that include penalties for critical service outages, or at least response-time guarantees during cyber incidents. At minimum, make sure you understand what your exposure is if they go dark.

4. Offline Playbooks and Emergency Workflow Planning

If licensing systems are down, how will you handle provisioning?

If ordering portals go offline, what are your manual procurement steps?

We help clients build BCP plans, but often forget to build them for ourselves. It’s time for MSPs to map out offline processes, backup communication lines, and interim workarounds—even for tasks that seem “cloud-native.”

5. Transparent Comms with Clients During Supply Chain Events

The temptation during vendor outages is to stay quiet. But transparent updates can be your saving grace:

• Acknowledge the issue
• Explain the cause (without throwing anyone under the bus)
• Outline your contingency steps
• Reassure clients that you’re in control—even if the upstream isn’t

Trust is built in the moments when things go wrong, not when everything’s working.

So What Happens Now?

The Ingram Micro outage will pass. Systems will recover. Reports will be filed. Lawsuits may follow.

But the MSPs who learn and evolve from this incident, those who reassess supply chain risk, diversify key dependencies, and implement stronger business continuity around vendors, will come out stronger.

This event should be the “WannaCry moment” for MSP operational design. A wake-up call that resilience doesn’t stop at your firewall, it stretches all the way up the supply stack.

After two jam-packed days at the MSP Show 2025, combined with SITS (Service Desk & IT Support Show), I’m back at the desk, slightly exhausted but full of ideas. And yes, that is Chewbacca in the photo with me and Richard. Because apparently, even in the world of managed services and vendors, you never know when a Wookiee might show up.

Bigger, Busier, and Buzzing

This year’s show was noticeably bigger than 2024, with hundreds of vendors under one roof, 40+ sessions, and more attendees than ever. The MSP Show is becoming a real must-attend for anyone in the channel, whether you’re an MSP, a vendor, or just someone curious about the state of the industry.

It’s also a networker’s paradise. Between sessions and vendor booths, I must’ve had 40 conversations, some planned, most spontaneous, and all valuable. It’s not often you can gather that much market insight, gossip, and inspiration in one place.

Session Highlights

Panel: How to Get the Best Out of Your MSP Vendor Relationships

Hosted by Michelle Coombs with panellists Paul Croker, Jane Matthews, Ben Spector, and Kim Simmonds – this session had some solid takeaways. There was a lot of focus on mutual accountability, communication, and transparency between vendors and MSPs.

A great discussion.

It’s Not a Rehearsal – Mark Copeman & David Weeks

This was an unexpectedly emotional session. Mark and David shared some very personal stories that really hit home. Their message? Life isn’t a rehearsal. You only get one shot at it, so stop working yourself into the ground and start making it count. A powerful reminder we all need from time to time.

Slow Down to Speed Up – Dan Scott

With perhaps the longest session title of the event, “Slow Down in Order to Speed Up: Unlock the Superpowers of Context & Understanding When Leading a Team”, Dan Scott delivered a brilliantly engaging talk. It included analogies involving insects, spiders, birds, bird poo, industrial cleaner, planes and an airport… and somehow it all made sense. A fantastic reminder that understanding the “why” behind the work is essential to leading effectively.

Surprise of the Show: Cloud Contracts 365

Among all the tech, tools, and acronyms, Cloud Contracts 365 stood out for me. Founded by Kim Simmonds, this is a seriously smart solution tackling a pain point most MSPs share, contract management.

Cloud Contracts 365 offers a comprehensive suite of tools to help MSPs take control of their contracts, something many MSPs admit is far from their strong suit.

Here’s what stood out:

Contract Builder

A smart tool that helps MSPs create legal contracts quickly and easily. No need to start from scratch or trawl through old templates, the platform walks you through creating contracts that are robust, compliant, and tailored to MSP services. Whether it’s an MSA, SLA, or NDAs, it’s designed to save time and reduce legal risk.

Contract Reviewer

Upload an existing contract and let the AI-driven reviewer flag risks, inconsistencies, and red flags. This is a game-changer for MSPs negotiating with suppliers or reviewing client agreements, especially for those without in-house legal teams. It’s like having a virtual lawyer on hand.

Contract Manager

This is the lifecycle management piece. Track renewal dates, termination clauses, change controls, and key commercial terms, all from one dashboard. No more forgotten renewals or missed revenue opportunities. It’s ideal for managing both client contracts and vendor agreements across your entire book.

Big thanks to Matt Hillier for the walkthrough, it was clear, practical, and genuinely useful.

As someone who’s seen too many MSPs buried in spreadsheets or chasing old PDFs, this felt like a solution that’s long overdue. A clean, modern platform that actually understands how MSPs operate.

One Gripe: The Session Spaces

My only bit of constructive feedback? The open session spaces. While it keeps the flow of the event moving, it made it hard to hear the speakers, especially when mics didn’t cooperate. A few sessions deserved better acoustics and more focused environments.

Let’s be blunt: most MSP leadership meetings are a colossal waste of time.

They’re scheduled with good intentions, alignment, accountability, momentum, but quickly devolve into status updates, random tangents, and a slow death by metrics. Everyone leaves feeling like they “did the right thing” but with no real change in direction, energy, or results.

So what’s going wrong?

1. You’re mistaking motion for progress.

A well-run meeting can create a false sense of productivity. You covered a lot. Everyone spoke. You updated your scorecard. But did you solve anything meaningful? Did you leave with fewer problems than you came in with?

Activity isn’t impact.

2. You’re stuck in the weeds.

Leadership meetings should focus on the business, not in it. That means strategic issues, not ticket trends or which engineer is behind on documentation. If your agenda is indistinguishable from your daily huddle, something’s broken.

3. You’re not getting uncomfortable.

Great leadership meetings have tension. Conflict. Debate. If everyone agrees too easily, you’re probably just circling safe topics. The real issues, the ones holding back growth, live in discomfort. You have to surface them, name them, and solve them.

4. You’re not making decisions.

Discussion is easy. Decisions are hard. If your meetings end with a lot of talk but no concrete actions, you’re stuck in limbo. Every week you’re having the same conversations because no one is accountable for moving anything forward.

5. You don’t actually need a meeting.

Sometimes the bravest thing a leadership team can do is cancel the meeting. If there’s nothing strategic to align on, no decisions to make, and no issues to solve, don’t meet. Go do the work.