Ransomware attack encrypts TG-iPASS database, portal goes offline

The portal, which provides government-to-business (G2B) services for industrial and manufacturing projects, became inaccessible at around 23.36 IST on October 22, according […]HYDERABAD: Telangana’s single-window clearance portal for businesses, TG-iPASS, has gone offline after a suspected ransomware attack encrypted its database and related files, prompting a criminal investigation by the Telangana Cyber Security Bureau (TGCSB). The portal, which provides government-to-business (G2B) services for industrial and manufacturing projects, became inaccessible at around 23.36 IST on October 22, according to a complaint filed by Sanga Suresh, joint director of industries. The TGCSB registered a case on Saturday.

An industries department official said the department had data backups and expected the website to be restored by Monday morning. “We have backup for data and the website will be up and running by Monday morning,” the official said. Encrypted files found on Cloud4C-hosted server According to the complaint, the TG-iPASS technical team could not connect to the database server hosted by Cloud4C.

The service provider was contacted and the server restarted, but the problem persisted. Further checks found that the SQL Server Agent service had stopped and could not be restarted. Subsequent inspection indicated that the server had been compromised and the database and related files encrypted, the complaint stated.

Investigators found that the affected files had been renamed with an unfamiliar “.vgb” extension. A note containing a contact email address and a machine identifier was also found on the server. No explicit ransom demand reported by investigators A TGCSB official said no monetary demand had been found so far, although the note provided an email address for contact.

“There was no demand for money; only contact mail ID was provided. The data appears to have been encrypted rather than deleted. As of now, the portal and database remain inaccessible,” the official said.

Investigators said the security measures in place were not satisfactory. The industries department has sought the deployment of an incident response team to investigate the breach and assess its full impact. The TGCSB has also been asked to ensure that the service provider does not format, reimage or otherwise alter the compromised server, as this could destroy digital evidence.

The bureau registered a case under Sections 43 and 66 of the Information Technology Act.