Telangana's single-window business clearance portal, TG-iPASS, has been knocked offline by a suspected ransomware attack that encrypted its database and related files, prompting a criminal investigation by the Telangana Cyber Security Bureau. The portal, through which the state government provides government-to-business services for industrial and manufacturing projects, became inaccessible at around 11.36 pm on 22 October.

Investigators found that affected files had been renamed with an unfamiliar ".vgb" extension, and a ransom note on the server contained a contact email address and a machine identifier. Officials said no monetary demand had been found in the note so far, and the evidence suggested the data had been encrypted rather than deleted. The portal and its database remained inaccessible during the initial investigation.

Forensic examination under way as officials point to backup data

The bureau has registered a case under Sections 43 and 66 of the Information Technology Act after a complaint from the industries department, and the affected server has been sent for forensic examination. Investigators are still examining whether attackers accessed or stole sensitive information and whether any data was transferred outside the network. Officials described the security measures in place as not satisfactory, and the bureau has asked that the compromised server not be formatted or reimaged, so that digital evidence is preserved.

An industries department official had earlier said backup data was available and services could be restored by Monday morning; The Hindu later reported the portal was expected to be restored within two days. The incident has halted the processing of industrial approvals in the state, leaving businesses that rely on the portal for clearances waiting for the system to return. No group has publicly claimed responsibility in the reporting so far, and the full impact of the attack has yet to be established.