Breaches and incidents
KiranaPro (India): AWS and GitHub root access used to delete servers and data
The quick-commerce startup said attackers accessed its AWS and GitHub root accounts around 24 to 25 May 2025 (discovered 26 May) and deleted EC2 servers...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- The quick-commerce startup said attackers accessed its AWS and GitHub root accounts around 24 to 25 May 2025 (discovered 26 May) and deleted EC2 servers, app code and backups; the founder later said it was an internal incident involving a fired employee and that consumer data remained intact.
- Root cause: disputed; first account says an MFA (Google Authenticator) code was changed and used to log in to AWS; later account blames a former employee who allegedly did not hand over GitHub credentials.
- Attacker: unresolved; FIR names former employees.
- Response: FIR filed, forensic review; TechCrunch reported the co-founder could not rule out an external hack.