Indian grocery startup KiranaPro was hacked and its servers deleted, CEO confirms

KiranaPro, an Indian grocery delivery startup, has fallen victim to a severe cyberattack that resulted in the complete deletion of its data, as confirmed by CEO Deepak Ravindran. The breach compromised critical information, including the company’s app code and sensitive customer details such as names, addresses, and payment information. Despite the app being online, it is currently unable to process orders. Founded in December 2024, KiranaPro operates on the Indian government's Open Network for Digital Commerce, facilitating grocery purchases from local vendors and supermarkets. The platform boasts 55,000 customers, with 30,000 to 35,000 active users across 50 cities, generating approximately 2,000 orders each day. Unique to KiranaPro is its voice-based ordering system, which supports multiple languages including Hindi, Tamil, Malayalam, and English. Just prior to the attack, the startup was gearing up for expansion into 100 additional cities within the next few months. The breach was detected on May 26 when executives attempted to log into their Amazon Web Services account. It appears hackers accessed KiranaPro's root accounts on both AWS and GitHub, potentially via credentials from a former employee's account. CTO Saurav Kumar indicated that the hack likely occurred around May 24-25. Although the startup employed Google Authenticator for multi-factor authentication, they discovered that the multi-factor code had changed, preventing access to their AWS account and resulting in the deletion of their Elastic Compute Cloud (EC2) services. KiranaPro is currently working with GitHub’s support team to trace the hacker's IP addresses and has initiated legal action against former employees who failed to provide necessary credentials for account access. The exact mechanics of the breach are still under investigation, with parallels drawn to previous significant cyberattacks linked to credential theft. KiranaPro is supported by investors including Blume Ventures, Unpopular Ventures, Turbostart, Olympic medalist PV Sindhu, and BCG MD Vikas Taneja, and operates with a small team of 15 employees based in Bengaluru and Kerala.