Hyderabad: Days after Telangana’s single-window business clearance portal, TG-iPASS, suffered a ransomware attack, officials of the industries department told TOI on Sunday that they had successfully decrypted the hijacked data.Late on Oct 22, unknown cybercriminals breached the portal’s security systems and encrypted crucial data relating to 28,000 companies registered with the state industries department. Data relating to another 7,000 companies that had sought renewal of their trade licences was also found encrypted.Officials said the attack disrupted TG-iPASS operations and kept the department on tenterhooks for two days.“We roped in a large team of experts who worked on it and successfully decrypted the data. There has, fortunately, been no loss of data,” said Nikhil Chakravarthi J, commissioner of industries, Telangana. Following the incident, he said the department was working to strengthen its firewalls and restore its systems for routine operations within the next two days.Officials said they were yet to ascertain who was behind the attack but suspected that the perpetrators could be operating from outside India.Previously, after encrypting the data, the attackers left an email ID in the database for officials to contact them. They did not specify a ransom amount. The industries department immediately approached the Telangana Cyber Security Bureau (TGCSB), which registered a criminal case under Sections 43 (penalty and compensation for damage to computer systems) and 66 (computer-related offences) of the Information Technology Act.According to the FIR, the TG-iPASS database server was hosted by Cloud4C. Initial attempts to recover the data were unsuccessful. Officials subsequently realised that the system’s security had been breached and that it was a ransomware attack, after finding unfamiliar files renamed with the.vgb extension.In the past, some Hyderabad-based companies have either paid ransom to recover their data or abandoned the encrypted data because they had backups.
Source link
