Hyderabad: A ransomware attack on Telangana’s flagship single-window business clearance portal TG-iPASS has knocked the system offline, with investigators finding the database encrypted. The breach has triggered a criminal investigation by the Telangana Cyber Security Bureau (TGCSB).TGCSB registered a case after receiving a complaint from Sanga Suresh, joint director of industries, on Saturday. According to the complaint, the TG-iPASS portal (ipass.telangana.gov.in), through which the state govt provides G2B (government-to-business) services, became inaccessible around 11.36 pm on Oct 22.Based on the complaint, TGCSB registered a case under Sections 43 and 66 of the Information Technology Act and launched an investigation into the cyberattack, which has left the state’s key business approvals platform out of service. Section 43 deals with penalty and compensation for damage to computer, computer system, etc., and section 66 (computer-related offences).While the investigators said that “the security measures were not satisfactory,” a top industries department official said: “We have backup for data and the website will be up and running by Monday morning.”The TG-iPASS technical team was unable to connect to the database server hosted by Cloud4C. “Cloud4C was contacted immediately and the server was restarted. However, the issue persisted. On further examination, it was observed that the SQL server agent service had stopped. Cloud4C was requested to start the service, but it could not be started. Subsequent inspection indicates that the server has been compromised and the database along with related files have been encrypted,” the complaint stated.Officials found that the affected files had been renamed with an unfamiliar “.vgb” extension. A ransom note containing a contact email address and machine identifier was also discovered on the server.“There was no demand for money; only contact mail ID was provided. The data appears to have been encrypted rather than deleted. As of now, the portal and database remain inaccessible,” a TGCSB official said.The complainant requested TGCSB to isolate the affected systems, preserve logs and disk images, conduct a forensic investigation, and determine whether any data was accessed or exfiltrated. The TGCSB was also asked to deploy an incident response team and ensure that the service provider does not format, reimage or alter the compromised server, preventing the loss of crucial digital evidence.
