Ingram has seven days to negotiate. As always, readers should treat the claims with some suspicion until independently verified. The SafePay crew may have entered Ingram's systems via its GlobalProtect VPN platform, sources told Bleeping Computer. This remains unconfirmed. SafePay was the most active ransomware crew in the world in May, according to threat intelligence service Fortra, with 70 attacks alone linked to the gang and its affiliates that month. Microlise was a high-profile victim attacked in October last year. Graham Cluley, Fortra's cybercrime researcher, said last month : "SafePay is known for breaking into organizations by using stolen VPN or RDP credentials. It has not been reported to have used phishing techniques frequently seen in many other ransomware attacks.