Ingram Micro Down. Ransomed. Why? Legacy MFA. Again.
By Kevin Surace | 3 minute read
Token Would Have Stopped This Cold.
Another week, another breach. This time it’s Ingram Micro, one of the largest tech distributors on the planet. Systems down for days. Operations halted. Now they’re staring down a ransomware demand, possibly for millions.
The entry point?
A GlobalProtect VPN login protected by legacy MFA.
You can’t make this up.
Reports suggest attackers used MFA fatigue tactics—repeatedly hitting users with push notifications until one person, just trying to stop the noise, tapped “approve.”
Just like that, the gates opened.
And everything behind them was up for grabs.
This isn’t the first time. It won’t be the last. Because legacy MFA is dead.
What would have actually stopped this?
Token.
Token Ring and Token BioStick were built specifically to prevent this exact attack vector. Let’s break it down.
- Proximity Requirement
Token authenticators only work when they’re physically next to the machine logging in. Not nearby. Not across the room. Within feet.
If a hacker’s trying from a remote spoofed system? Game over. The device won’t respond.
- FIDO2-Based Cryptography
Token uses true public/private key encryption, not shareable secrets like one-time codes or SMS. Credentials are locked to the device and the domain.
No code to phish. Nothing to forward. Nothing to replay.
- Biometric Fingerprint Match
No fingerprint? No login.
A hacker can’t fake your thumb. A social engineer can’t guess your biometrics. Only you can authenticate.
- Origin Binding
Even if the attacker creates a pixel-perfect spoofed login page, it won’t matter.
Token devices check the exact domain during login and if it doesn’t match the registered site, authentication fails silently.
No error. No warning.
Just: “Nope.”
Let’s be blunt.
Ingram Micro didn’t have Token.
So they got owned.
And so will every other enterprise still relying on push apps, SMS codes, or TOTP tokens to “secure” their network access.
This is 2025.
Your adversaries have AI-generated phishing, spoofed login pages, cloned VPN portals, and more social engineering playbooks than you can imagine.
They don’t need to break in. They just need one employee to click.
The uncomfortable truth?
Security awareness training won’t save you.
MFA apps won’t save you.
Hope and policy won’t save you.
Only phishing-resistant architecture will.
And Token is that architecture.
No one is safe without it.
A single MFA approval can take down an entire billion-dollar enterprise.
It happened to Ingram. It happened to Aflac. Hawaiian Airlines. Qantas. MGM. Caesars.
Who’s next?
If your MFA can be phished, spoofed, or fatigued, you’re already compromised.
You just don’t know it yet.
Want to stop it cold?
Get Token. Or get ransomed.
Sign Up
Keep up to date with phishing and ransomware news.
Token will not sell, trade, lease, or rent your personal data to third parties.
