Major cyber attack on grocery app, users' bank details and sensitive data deleted

Indian grocery delivery startup KiranaPro has experienced a significant cyber attack that not only halted the company's app but also completely erased the sensitive data of its users. Company founder Deepak Ravindran has confirmed this and stated that hackers have infiltrated the system and entirely deleted the app's code, customer details, names, addresses, and payment-related information. 

Launched in December 2024, KiranaPro was an innovative voice-based grocery ordering app that allowed users to place orders in languages such as Hindi, Tamil, Malayalam, and English. The app connected customers to local grocery stores in 50 cities across the country and processed approximately 2,000 orders daily. The company was planning to double its network in the next 100 days, but the cyber attack on May 26 brought the entire system to a standstill.

According to the company, the attack was detected when the team could not log in to the Amazon Web Services (AWS) account. Investigation revealed that hackers had accessed the company's root AWS and GitHub accounts, which were done through the login credentials of a former employee.

All EC2 servers (virtual machines) of KiranaPro were deleted in this attack. While the company was using two-factor authentication, hackers still broke into the system. Currently, the company is trying to trace the attacker in collaboration with GitHub and is preparing to take legal action against former employees who did not return their access credentials.

Notably, KiranaPro has the support of big investors like Blume Ventures and Olympic medalist PV Sindhu. However, after this serious cyber attack, the company's path ahead has become very difficult.