Telangana’s TG-iPASS single-window business clearance portal has recovered data encrypted during a ransomware attack that disrupted its operations for nearly 48 hours. The cyberattack affected records belonging to approximately 35,000 companies, including businesses registered with the state industries department and those seeking renewal of trade licences.
Officials confirmed on Sunday that cybersecurity specialists had successfully decrypted the affected information, with no reported data loss.
How Did Hackers Breach the TG-iPASS Portal?
Unknown cybercriminals breached the portal’s security systems late on October 22 and encrypted crucial data belonging to approximately 28,000 companies registered with the industries department.
Information concerning another 7,000 companies seeking renewal of their trade licences was also encrypted, disrupting the department’s routine operations. The attack left officials unable to access important business records for two days.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Was the Encrypted Data Recovered?
Telangana Industries Commissioner Nikhil Chakravarthi said a large team of experts had been deployed to recover the affected information.
He confirmed that specialists successfully decrypted the data without any reported loss.
The department is now strengthening its firewalls and restoring normal operations, with officials expecting the systems to resume routine functioning within two days.
Did the Attackers Demand a Ransom?
Following the breach, the attackers left an email address in the database, apparently allowing officials to establish contact. However, they did not specify any ransom amount.
Initial attempts to recover the encrypted information were unsuccessful, prompting further examination of the compromised systems.
What Did the Cybercrime Investigation Reveal?
According to the First Information Report, the TG-iPASS database server was hosted by Cloud4C. Officials subsequently identified unfamiliar files carrying the `.wygb` extension, which helped establish that the incident involved ransomware.
Authorities have not identified those responsible for the attack, although officials suspect the perpetrators may be operating outside India.
What Legal Action Has Been Taken
The industries department approached the Telangana Cyber Security Bureau, which registered a criminal case under Sections 43 and 66 of the Information Technology Act.
These provisions concern damage to computer systems and computer-related offences. The bureau is investigating the security breach and attempting to establish the attackers’ identities.
What Does This Mean
The incident highlights the operational risks ransomware attacks pose to government digital services handling large volumes of business information.
Although officials have confirmed successful data recovery, the disruption demonstrates the importance of stronger cybersecurity safeguards, reliable recovery mechanisms and continued monitoring of critical government platforms.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
