Hackers Delete Servers of Indian Grocery Startup KiranaPro

Hackers deleted all data belonging to the Indian grocery startup KiranaPro by wiping its servers. The company’s source code and all customer information, including sensitive data, have been destroyed

According to TechCrunch’s exclusive, Deepak Ravindran, KiranaPro co-founder and CEO, confirmed that malicious actors have attacked the company, but the method remains unclear. The company is investigating the incident with assistance from GitHub’s support team.

KiranaPro, launched in December 2024, allows users to buy their groceries from local shops and supermarkets in their local area. The startup had reached a user base of 50,000 with over 30,000 active customers across 50 cities in India. The company operates the Indian government’s Open Network for Digital Commerce as a buyer app, but it cannot process orders at the moment.

Saurav Kumar, KiranaPro’s chief technology officer, told TechCrunch that the breach happened a few days ago, between May 24 and 25. On May 26, the team noticed unauthorized access to the company’s Amazon Web Services (AWS) and GitHub accounts.

The startup suspects that the attackers gained access through a former employee, as they used multi-factor authentication on its AWS account, and it had been changed.

“We can only log in through the IAM [Identity and Access Management] account, through which we can see that the EC2 instances don’t exist anymore, but we are not able to get any logs or anything because we don’t have the root account,” said Kumar to TechCrunch.

The startup expects to track multiple traces and IP addresses to find the hacker and is also filing cases against a former employee who never submitted credentials

Before the incident, KiranaPro expected to expand to 100 more cities within the next few months. The company had been backed by Unpopular Ventures, Turbostart, and Blume Ventures.

Despite the concerning situation, Ravindran remains optimistic and said they will fight for justice and continue to develop their services and technology. The CEO shared an encouraging message on his Instagram account:

Even if they delete our code,

they can’t delete our courage.

Even if they hack our servers,

they can’t hack our spirit.

We built it once.

We’ll build it again.

Malicious actors have also been targeting other companies in India, including India’s largest health insurer Star Health—the hacker xenZen recently sent death threats to its CEO and CFO.