TG-iPASS recovers data after ransomware attack
Late on Oct 22, unknown cybercriminals breached the portal’s security systems and encrypted crucial data relating to 28,000 companies registered with the state industries department. Data relating to another 7,000 companies that had sought renewal of their trade licences was also found encrypted.
Officials said the attack disrupted TG-iPASS operations and kept the department on tenterhooks for two days. There has, fortunately, been no loss of data,” said Nikhil Chakravarthi J, commissioner of industries, Telangana. Following the incident, he said the department was working to strengthen its firewalls and restore its systems for routine operations within the next two days. Officials said they were yet to ascertain who was behind the attack but suspected that the perpetrators could be operating from outside India.
“We roped in a large team of experts who worked on it and successfully decrypted the data. Hyderabad: Days after Telangana ’s single-window business clearance portal, TG-iPASS, suffered a ransomware attack, officials of the industries department told TOI on Sunday that they had successfully decrypted the hijacked data.
Because they had backups, in the past, some Hyderabad-based companies have either paid ransom to recover their data or abandoned the encrypted data. You Can Also Check: Gold Rate in Hyderabad | Silver Rate in Hyderabad | Bank Holidays in Hyderabad | Public Holidays in Hyderabad | Hyderabad AQI | Weather in Hyderabad | Petrol Price in Hyderabad | Diesel Price in Hyderabad | CNG Price in Hyderabad | LPG Price in Hyderabad Stay updated with the latest Hyderabad news. Download the TOI App.
The industries department immediately approached the Telangana Cyber Security Bureau (TGCSB), which registered a criminal case under Sections 43 (penalty and compensation for damage to computer systems) and 66 (computer-related offences) of the Information Technology Act.
The TG-iPASS database server was hosted by Cloud4C, according to the FIR. They did not specify a ransom amount. Initial attempts to recover the data were unsuccessful. Officials subsequently realised that the system’s security had been breached and that it was a ransomware attack, after finding unfamiliar files renamed with the.vgb extension.
Previously, after encrypting the data, the attackers left an email ID in the database for officials to contact them.