Telangana’s single-window portal for industrial clearances, TG-iPASS, has been disrupted since October 22 after a suspected ransomware attack. Investigators are now examining the affected server to find out whether anyone stole data, and officials say backups are available while restoration work is underway.

The outage has stopped the processing of industrial permissions through a platform that businesses rely on to obtain government clearances. For companies waiting on approvals, the portal’s silence means applications are stuck in limbo with no firm date for when they will move again.

What officials found on the server

Officials discovered that the portal’s database had been encrypted and that file names had been altered with the extension ‘vgb’. That finding is the backbone of the ransomware suspicion. A ransom note was also reportedly discovered on the server, which pushed officials further toward treating the incident as a ransomware attack.

The picture is unusual, though. The hackers have reportedly not demanded any money. Instead, they left only an email address for communication. Ransomware attacks typically come with a payment demand, so the absence of one is a detail that investigators will need to explain.

The hackers have reportedly not demanded any money and have provided only an email address for communication.

A criminal case and a forensic race

The Telangana Cyber Security Bureau has started an investigation after a complaint lodged by the joint director of the Industries Department. A case has been registered under Sections 43 and 66 of the Information Technology Act. Section 43 deals with unauthorised access to and damage of computer systems, while Section 66 covers computer-related offences. Those provisions give investigators the legal basis to pursue the case as the technical probe moves forward.

The technical work is the harder part. Forensic examination of the affected server is meant to determine whether any data was stolen or transferred outside the system. Until that question is answered, the full extent of the security breach and the possible compromise of sensitive information remain unknown. Officials have not yet been able to say how far the intrusion reached.

Why businesses are feeling the pressure now

TG-iPASS is described as a key platform for businesses seeking government clearances. When it goes dark, the approvals that depend on it stop moving. The disruption has directly affected industrial permissions, and that puts pressure on companies that planned their operations around timely clearances.

The outage has now run since October 22. The reporting does not say how many applications were affected or how long each one has been delayed. Those numbers matter, and they are not yet public, so they should not be assumed. What is clear is that a single digital gateway has become a bottleneck for a process that many businesses cannot avoid.

The Telangana angle

This is a state government system, which makes the story a direct Telangana matter. The portal sits at the point where industrial clearances are processed, so its failure is felt across the state’s industrial approval process rather than in one office or one department. For anyone in Telangana planning an industrial project, the outage is a practical problem with no clear end date yet.

Digital infrastructure under pressure

Government portals hold sensitive records and sit at the centre of public services, which makes them attractive targets. An encrypted database is not only an IT problem. It becomes a test of how quickly the state can detect an intrusion, contain it, and restore services without losing public trust.

The fact that officials say backups exist is the most concrete reassurance in the reporting so far. Technical teams have started restoration, and officials are aiming to bring the portal back online soon. Restoring from backups, however, is only one step. Investigators still need to confirm that the copies are clean and that the attackers did not remain inside the system.

What is still unconfirmed

Several critical points remain open. It is not yet known whether data was stolen, who is behind the attack, how many users were affected, or exactly when full service will return. The reporting has not confirmed the scope of any compromised information, and officials have not publicly tied the incident to a specific group.

For now, the facts are narrow but serious. A state portal that businesses depend on has been locked since October 22. The database was encrypted, a ransom note was reportedly left behind, and a criminal case is under way. The next answers will come from the forensic examination, and the biggest question is whether any sensitive data has already left the system.