A ransomware attack has disrupted Telangana’s flagship single-window business clearance platform, TG-iPASS, leaving the portal inaccessible after attackers allegedly compromised its server and encrypted the database. The Telangana Cyber Security Bureau (TGCSB) has registered a case and launched an investigation into the incident, which has affected the state’s business approval services.
The portal, accessible through ipass.telangana.gov.in, reportedly became unavailable around 11.36 pm on October 22. Officials said backup data was available and expressed confidence that services could be restored by Monday morning.
How Was the Attack Detected?
The incident came to light when the TG-iPASS technical team was unable to connect to its database server hosted by Cloud4C.
The service provider was contacted immediately, and the server was restarted. However, the problem persisted.
Further examination revealed that the SQL Server Agent service had stopped functioning. Cloud4C was asked to restart the service but could not do so.
Subsequent inspection indicated that the server had been compromised and the database, along with related files, had been encrypted.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Did Investigators Find?
Officials discovered that affected files had been renamed with an unfamiliar “.vgb” extension. Investigators also found a ransom note containing a contact email address and machine identifier.
However, the note did not specify any ransom amount.
A TGCSB official said the available evidence suggested that the data had been encrypted rather than deleted. The portal and database remained inaccessible during the initial investigation.
What Legal Action Has Been Taken?
TGCSB registered a case following a complaint from Sanga Suresh, Joint Director of Industries.
The case was registered under Sections 43 and 66 of the Information Technology Act, covering damage to computer systems and computer-related offences.
Investigators are examining how the attackers gained access and whether any information was accessed or extracted.
When Will Services Resume?
A senior Industries Department official acknowledged that existing security measures were unsatisfactory. However, the official confirmed that backup data was available and said the government expected the portal to become operational by Monday morning.
The disruption has temporarily affected the state’s government-to-business services, which rely on TG-iPASS for business approvals.
What Happens Next?
The complainant requested TGCSB to isolate affected systems, preserve logs and disk images, and conduct a forensic investigation. Authorities were also asked to deploy an incident response team and ensure that the service provider did not format, reimage or alter the compromised server.
Preserving the original system is considered important for examining digital evidence and determining whether any data was accessed or stolen.
What Does This Mean?
The attack highlights cybersecurity risks facing government platforms that provide essential business services. Although backup data may support restoration, investigators must establish how the server was compromised and whether sensitive information was exposed. The incident also raises questions about the effectiveness of existing security safeguards.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
