TG-iPASS Portal Down Since 22 October After Suspected Ransomware

Telangana’s online portal for industrial approvals, TG-iPASS, has been offline since late on 22 October after its database server was compromised and its files encrypted, according to a police complaint filed by the state’s industries department. “The available indications suggest a ransomware attack,” Joint Director of Industries S Suresh wrote in the complaint to the Telangana Cyber Security Bureau (TGCSB), The New Indian Express reported.

TG-iPASS is the state’s single-window system for government-to-business services, used to fast-track approvals for new factories and service businesses. It became inaccessible at around 11.36pm on 22 October, according to the complaint as reported by The Times of India. The TGCSB has registered a case under sections 43 and 66 of the Information Technology Act. When TSN checked on 25 October, the portal still showed a notice saying “Server is temporarily unavailable”.

What the complaint describes

The problem began when the TG-iPASS application could not connect to its database server, which is hosted by the cloud provider Cloud4C. According to the complaint, Cloud4C restarted the server but the problem persisted. Engineers then found that the SQL Server Agent service had stopped, and it could not be restarted.

“Inspection later indicates that the server has been compromised and that the database and related files have been encrypted,” the complaint says, as quoted by The New Indian Express. “The affected files bear an unfamiliar extension (.vgb), and a ransom note displaying a contact email address and a machine identifier ID was found on the server.” Screenshots of the encrypted files were given to police.

The note did not set a price, according to the TGCSB. “There was no demand for money; only contact mail ID was provided. The data appears to have been encrypted rather than deleted. As of now, the portal and database remain inaccessible,” a TGCSB official told The Times of India. The complaint was filed on Saturday 24 October, the paper reported. No group has claimed the attack, and none of the reports names one.

What the department has asked investigators to do

The complaint reads like an incident-response checklist. According to The New Indian Express, officials asked police to help contain and isolate the affected systems and to preserve logs, disk images and other digital evidence. They want a forensic investigation to establish the attack vector and scope, identify indicators of compromise and “assess any unauthorised access or data exfiltration”. They also want investigators to identify and validate clean backups.

The Times of India reported that the department also asked the TGCSB to deploy an incident response team, and to make sure the service provider does not “format, reimage or alter the compromised server”. Response teams have been sent to work with the department, Cloud4C and the TG-iPASS technical team, according to The New Indian Express.

Officials say backups exist and give two timelines

Officials have since sounded more confident. A senior industries department official told The Times of India: “We have backup for data and the website will be up and running by Monday morning.” The same report said investigators had found that “the security measures were not satisfactory”.

On Sunday, Director of Industries Nikhil Chakravarthy said in a statement, reported by The Hindu: “We have taken back control of the portal from cyber criminals. The website is being equipped with stronger cyber security firewalls and will be made available again within two days.” The Hindu reported that the platform’s data “remains safe on the server”. Neither statement says how the attackers got in or whether any data left the server.

Ransomware that encrypts files and leaves a contact address is a familiar pattern, and the defences are familiar too. In a joint advisory, the FBI, CISA and UK police described how the SafePay gang wipes backups before locking files, and recommended “offline, encrypted and immutable backups that are tested regularly”. In Wales, the UK data regulator reprimanded two public bodies after a “Password1” account let ransomware in. Outages can also be deliberate: a minister told the Lords that 32 UK government services were offline after PHP2Shell, mostly as a precaution.

The backups matter more than the restart date

The two timelines from officials, Monday morning and “within two days” from Sunday, differ by only about a day. The bigger question is whether the restored system is clean. The complaint itself puts that question first: it asks for backups to be “validated”, not simply restored, and for the server to be left untouched as evidence. That order is deliberate. Bringing a portal back from a backup taken after attackers got in can quietly restore their access too. So Chakravarthy’s promise of new firewalls before reopening probably matters less than whether forensic work has found the way in.

Not knowing what was taken is the main gap

Encryption with a contact address and no stated price leaves the attackers’ aims unclear. The officials’ statements so far are about availability: the data is backed up, it was encrypted rather than deleted, and it is “safe on the server”. None of that answers the question the complaint asks investigators to settle, which is whether data was accessed or copied out. TG-iPASS handles industrial applications for businesses across the state, so the answer matters to them more than the restart date. Until the TGCSB reports on exfiltration, the safe assumption for businesses that filed through the portal is that the investigation is still open.

TSN follows these incidents on its ransomware and cyber attacks hub.

Sources

• The New Indian Express: TG-iPASS portal fails ransomware attack test, 25 October 2026
• The Times of India: Cyber attack knocks out TG-iPASS; govt says backup available, 25 October 2026
• The Hindu: TG-iPASS portal to be restored in two days after cyberattack, 25 October 2026
• TG-iPASS portal (service notice)

Related stories

• SafePay Ransomware Has Hit at Least 600 Victims, FBI, CISA and UK Police Warn
• ICO Reprimands Two Welsh Bodies After ‘Password1’ Account Let Ransomware In
• 32 UK Government Services Offline After PHP2Shell, Minister Says
• Ransomware and Major Cyber Attacks: TSN Story Hub