A suspected ransomware attack has knocked Telangana’s TG-iPASS portal offline, putting a sharp spotlight on the security of the digital platforms that state governments now depend on to deliver services. The single-window system, which businesses use to obtain industrial clearances, has been disrupted since 22 October.
According to officials, the portal’s database was found encrypted and file names had been changed to carry a “.vgb” extension. A ransom note was reportedly left on the server. Unusually, the attackers have not demanded a specific sum so far and have shared only an email address for contact.
Investigation under way
The Telangana Cyber Security Bureau has opened an investigation after a complaint from a joint director of the Industries Department, and a case has been registered under Sections 43 and 66 of the Information Technology Act. Investigators are carrying out a forensic examination of the affected server to establish whether any data was stolen or moved out of the system. The full extent of the breach is yet to be determined.
The Industries Department has said that data backups are available, and technical teams have begun restoring the system with the aim of bringing the portal back online soon. In the meantime, processing of industrial permissions through TG-iPASS has been affected.
State moves to harden eOffice
The incident comes as the state’s Information Technology, Electronics and Communications (ITE&C) department steps up cyber hygiene across government systems following national alerts on vulnerabilities in PHP-based applications. CERT-In had flagged two critical PHP flaws that could let attackers run malicious code remotely on affected servers, and the National Informatics Centre (NIC) instructed states to upgrade PHP in eOffice, the digital file management system used across government.
The Telangana Security Operations Centre (TSOC) issued a threat advisory to departments on 23 October, asking them to review PHP-based applications, apply security patches on priority and report compliance. The ITE&C department said upgrades to PHP version 8.3.36 have been completed in almost all of the state’s 33 eOffice instances, while technical issues with the Secretariat instance are being addressed. Officials added that no cyber incidents or service disruptions linked to these particular vulnerabilities have been reported so far, and that applications hosted at the State Data Centre are under continuous monitoring.
A CISO for every department
Telangana IT Adviser Sai Krishna said the state relies on regular security audits of government websites and is upgrading systems as patches become available. Around 60,000 website instances across India have been identified as potentially exposed to the critical PHP flaws. The government is also in the process of appointing a Chief Information Security Officer (CISO) for every department, so that each has a clear point of accountability for cybersecurity.
Why it matters
Single-window portals such as TG-iPASS sit at the heart of ease-of-doing-business reforms, and an outage of several days directly slows investment approvals. The episode underlines that as more governance moves online, resilience, tested backups, rapid incident response and departmental accountability for security need to be built in from the start rather than added after an attack.
Sources: Telangana Today; The New Indian Express.