TG-iPASS is Telangana's main online system for approving new industrial projects. A ransomware attack took it offline late on October 22, 2026, after attackers encrypted the database behind it. The Telangana Cyber Security Bureau (TGCSB) has registered a criminal case under Sections 43 and 66 of the Information Technology Act. The case follows a complaint from the state industries department. According to the complaint, as reported by The Times of India, the portal's database and related files on a server hosted by Cloud4C were encrypted and renamed with a ".vgb" extension. A ransom note was left behind. A senior industries department official said a backup exists and that the site would be "up and running by Monday morning." None of the available reporting comes from a primary source. There is no official statement from the state, no CERT-In advisory, and nothing from Cloud4C, so the details below rely on press accounts of the police complaint.
What Happened
The Times of India has the most detailed account. According to the complaint, ipass.telangana.gov.in became inaccessible at about 11:36 pm IST on October 22. The TG-iPASS technical team could not connect to the database server, which is hosted by the cloud provider Cloud4C. Cloud4C restarted the server, but the problem continued. Engineers then found that the SQL Server Agent service had stopped and could not be restarted. A closer look showed the server had been compromised and that "the database along with related files have been encrypted."
The encrypted files carried an unfamiliar ".vgb" extension. Investigators also found a ransom note containing a contact email address and a machine identifier.
Accounts differ on who filed the complaint. The Times of India names Sanga Suresh, joint director of industries, and says TGCSB registered the case after receiving the complaint on Saturday. TeluguNow's English and Telugu reports describe the complainant as "Director of Industries Suresh." That is most likely the same person with a different title, but the exact role has not been officially confirmed.
There is also disagreement about the ransom note. The Times of India quotes investigators saying there was "no demand for money; only contact mail ID was provided." TeluguNow reports that the note was linked to an email ID "DataLeaks5" and that the portal's database and the encrypted files were attached to it. No other source confirms that the database was attached. The "DataLeaks5" identifier comes only from TeluguNow and should be treated as unverified.
What Was Taken
It is not yet known whether any data was stolen. No source gives a record count, and no data has been publicly confirmed as taken.
- Confirmed (per the complaint, as reported by TOI): The production database and related files were encrypted, which made the portal unavailable.
- Unconfirmed: TeluguNow says investigators are still working out "if any information was accessed or stolen." Its claim that the database was attached to the ransom note would, if true, mean the attackers took a copy of the data before encrypting it. Nothing else corroborates this.
- What may be exposed: TG-iPASS links more than 25 state departments, including Pollution Control, Urban Development, Fire Services and Power (IMPRI). Its database probably holds investor identities, project plans, land and site details, compliance self-certifications and paperwork submitted for approvals. A leak would put commercially sensitive business information at risk. Personal data would be a smaller part of it.
The comment that the note had no ransom demand, only a contact email, does not reduce the risk. Many ransomware groups make their first contact this way and only name a price, or threaten to publish data, after the victim replies.
Why It Matters
It disrupts legally guaranteed approvals. IMPRI notes that TG-iPASS was created under the TS-iPASS Act, 2014. The Act gives entrepreneurs a legal right to clearances within 1 to 30 days and a right to be told the reasons for any delay. If the portal stays down, the state may fall behind on those deadlines across every connected department.
The timing is bad for investment. The Hindu reports that IT and Industries Minister D. Sridhar Babu was in Bengaluru the week before, promoting the Invest Telangana Global Summit 2026 (December 7 to 9 in Hyderabad). The portal that would process approvals for those investments is now under investigation.
Investigators reportedly found weak security. The Times of India quotes investigators saying "the security measures were not satisfactory." This suggests basic security gaps rather than an unusually sophisticated attack.
It adds to a heavy workload for TGCSB. The bureau recently finished a six-state operation against money mule accounts that led to 101 arrests and traced about ₹17 crore in fraud (The Hindu). It is also investigating a separate October 19 incident in which attackers abused a Hyderabad NBFC's API to move more than ₹3.3 crore through 183 transactions in 87 minutes (Telangana Tribune). Those cases are not linked to this one. Together, they show how many serious cyber incidents the Telangana authorities are handling at the same time.
It fits a long-running pattern. India has a record of large public-sector exposures, including the Aadhaar leaks reported in 2018 (Wikipedia, Data breaches in India). Government portals that collect data from many departments remain high-value targets.
The Attack Technique
The initial access method has not been disclosed. What the reports do show:
- Target: A SQL Server database host managed by Cloud4C. The SQL Server Agent service stopped and would not restart, which fits with the database files being locked or encrypted.
- Impact: The database and related files were encrypted and renamed with a ".vgb" extension. A note containing an email address and a machine ID was left on the server. Some ransomware families use per-machine IDs to track victims and keys.
- Attribution: No group has been publicly named. The ".vgb" extension does not clearly match a well-known ransomware brand in the reporting so far. The "DataLeaks5" identifier reported by TeluguNow suggests the attackers may threaten to leak data, but that is not established.
- Probable entry points (analyst assessment, unconfirmed): For internet-facing database servers hosted by managed service providers, the usual routes are exposed RDP or SQL ports, reused or weak administrator passwords, unpatched web application vulnerabilities, and compromised provider or vendor remote-access accounts. The investigators' comment about unsatisfactory security makes one of these routes more likely than a zero-day exploit.
The split responsibility between the department, its technical team and Cloud4C is worth watching. When a hosting provider manages the infrastructure, it is often unclear who owns patching, monitoring and access control. That kind of gap is a common cause of incidents like this.
What Organizations Should Do
- Never expose database servers directly to the internet. Put SQL Server behind application tiers and private networking. Block direct access to ports 1433 and 3389 from the internet, and require MFA plus a jump host for any administrative access.
- Keep backups offline and immutable, and test them. The state says it has a backup. Restoration claims should be checked against how recent the backup is and whether it has been tampered with. Keep at least one offline or immutable copy, and run restore drills regularly.
- Write security duties into contracts with hosting providers. Contracts with cloud and MSP providers should state clearly who handles patching, endpoint detection, log retention and incident notification. Audit provider remote-access accounts and require MFA for them.
- Monitor database hosts for early warning signs. Alert on SQL Server Agent or SQL services stopping unexpectedly, mass file renames, volume shadow copy deletion, and unusually large outbound transfers. These usually appear before or during encryption.
- Assume data was stolen until proven otherwise. Review network flow and egress logs for signs of staging or upload before encryption. Prepare to notify affected businesses and departments if theft is confirmed.
- Rebuild from a known-clean state. Do not just restore data onto the compromised host. Rebuild the server, rotate all credentials and service accounts, and find the root cause before going back online, so the attackers cannot simply return.
Sources: Cyber attack knocks out TG-iPASS, govt says backup available Hyder... | 101 held in TGCSB’s six-State sweep, ₹17 crore cyber fraud trail un... | Telangana, Karnataka can form integrated industrial value ... | Ransomware Attack Reported on Telangana’s TG-iPASS Portal TeluguNo... | టీజీ-ఐపాస్ సర్వర్పై సైబర్ దాడి! TeluguNow.com | Data breaches in India | 183 Transactions, 52 Accounts: Hackers Drain Rs 3.3 Crore From Hyde... | Telangana State Industrial Project Approval And Self-Certification...