Disgruntled Former Employee Deletes Servers Worth Rp12.8 Billion After Dismissal
A vengeful former technology expert has been sentenced to prison for illegally hacking into his previous company’s internal database and sabotaging hundreds of virtual servers, resulting in massive financial losses. The 39-year-old Indian national, Kandula Nagaraju, committed the cyber sabotage after his contract with Singapore-based IT services firm NCS was terminated.
Exploiting a security loophole where his old login credentials had not been revoked, he infiltrated the corporate testing system and unilaterally wiped out 180 virtual servers. The company estimated the damage at approximately S$918,000, equivalent to Rp12.8 billion. The case concluded with the perpetrator receiving a prison sentence of two years and eight months.
During the trial, it was revealed that the perpetrator felt aggrieved by the termination of his contract. He expressed disappointment, believing he had performed well during his tenure with the company. According to court documents, Kandula’s contract with NCS was terminated in October 2022 due to poor performance, with his last working day on 16 November 2022. He felt confused and upset upon being dismissed, as he felt he had worked well and contributed positively to NCS. After leaving the firm, he had no other employment in Singapore and had to return to India.
Between November 2021 and October 2022, Kandula was part of a 20-member team managing the quality assurance (QA) computer systems at NCS, a firm offering information, communications, and technology services. The system his former team managed was used to test new software and programmes before launch. In a statement, NCS clarified that it was a “standalone testing system” comprising roughly 180 virtual servers, and no sensitive information was stored on it.
Following the termination of his contract and his return to India, Kandula used his laptop to gain illegal access to the system using administrator login credentials. He did so on six occasions between 6 and 17 January 2023. He returned to Singapore in February 2023 after securing new employment and rented a room with a former NCS colleague, using the colleague’s Wi-Fi network to access the NCS system once more on 23 February 2023. During these months of unauthorised access, he wrote several computer scripts to test whether they could be used to delete servers on the system.
In March 2023, he accessed the NCS QA system 13 times. On 18 and 19 March, he executed a script programmed to delete the 180 virtual servers, one by one. The following day, the NCS team realised the system was inaccessible and attempted troubleshooting without success, subsequently discovering that the servers had been wiped. A police report was lodged on 11 April 2023, and several IP addresses uncovered during an internal investigation were handed over to the authorities. Kandula’s laptop was seized, and the deletion scripts were found on the device. Investigations revealed he had searched Google for scripts to delete virtual servers, which he then used to code his own. NCS suffered a total loss of S$917,832 as a result of his actions.