HYDERABAD: The Telangana State Industrial Project Approval and Self-Certification System (TG-iPASS) portal went offline on Thursday night after its application failed to connect to the database server. Subsequent checks indicated that the server had been compromised, with the database and related files encrypted in what officials suspect was a ransomware attack.
When TNIE attempted to access the website, it displayed the message: “Server is temporarily unavailable. We are working on it... Our team is working to restore the service as soon as possible”.
In his complaint to the Telangana Cyber Security Bureau (TGCSB), Joint Director in the Commissionerate of Industries S Suresh detailed the sequence of events. He said Cloud4C, which hosts the portal, was contacted immediately after the application failed to connect to the database, and the server was restarted. However, the problem persisted.
Further examination revealed that the SQL Server Agent service had stopped. Cloud4C was asked to restart it, but the service could not be started.
“Inspection later indicates that the server has been compromised and that the database and related files have been encrypted. The affected files bear an unfamiliar extension (.vgb), and a ransom note displaying a contact email address and a machine identifier ID was found on the server.
TG-iPASS app & database unavailable, police help sought
“The available indications suggest a ransomware attack,” Suresh stated in his complaint.
He noted that while the data appeared to have been encrypted rather than deleted, the TG-iPASS application and database remained unavailable. Screenshots of the encrypted files were submitted to the police for reference.
Officials have sought police assistance to contain and isolate the affected systems and preserve logs, disk images and other digital evidence. They have also requested a forensic investigation to determine the attack vector and scope, identify indicators of compromise, assess any unauthorised access or data exfiltration, and identify and validate clean backups.
The complaint also sought the restoration of the TG-iPASS application and database services using validated clean backups or recovered data, along with the complete recovery of the encrypted database and related files, ensuring the completeness and integrity of the recovered data.
Following the incident, response teams were deputed to coordinate with the department, Cloud4C and the TG-iPASS technical team. Based on the complaint, the TGCSB registered a case and launched an investigation.
The TG-iPASS portal serves as Telangana’s single-window platform for delivering Government-to-Business (G2B) services. It is designed to fast-track the setting up of industrial units, manufacturing facilities and service enterprises in the state.
