Dismissed Former Employee Deletes Servers Worth Rp11 Billion
A former employee from India is reported to have sabotaged a system after being dismissed from his job. Kandula Nagaraju, 39, accessed the internal system of his former employer and deleted hundreds of virtual servers, resulting in substantial losses.
The incident took place after he stopped working for Singapore-based technology company NCS. Using his old access, he entered the company’s testing system and issued commands that deleted all 180 virtual servers.
The company was estimated to have suffered losses of around S$918,000, equivalent to Rp11.1 billion. The case went to court, and Nagaraju was sentenced to two years and eight months in prison.
During the trial, it emerged that he had been unhappy about the termination of his contract. He said he was disappointed because he believed he had performed well while working for the company.
CNA reported that Kandula’s contract with NCS was terminated in October 2022 due to poor performance. His last day at work was 16 November 2022. According to court documents, Kandula felt confused and upset when he was dismissed, as he believed he had worked well and made a good contribution to NCS. After leaving the company, he had no other job in Singapore and had to return to India.
Timeline
From around November 2021 to October 2022, Kandula was part of a 20-person team managing NCS’s quality assurance (QA) computer system. NCS provides information, communications and technology services. The system managed by Kandula’s former team was used to test software and new programmes before they were launched.
In a statement to CNA on Wednesday, NCS said it was a “standalone testing system”. It comprised around 180 virtual servers and contained no sensitive information.
After his contract was terminated and he had returned to India, Kandula used his laptop to gain unauthorised access to the system with administrator login credentials. He did this six times between 6 and 17 January 2023.
In February that year, Kandula returned to Singapore after looking for a new job. He rented a room with a former NCS colleague and used the colleague’s Wi-Fi network to access NCS’s system once, on 23 February 2023.
During the unauthorised access over those two months, he wrote several computer scripts to test whether they could be used to delete servers from the system.
In March 2023, he accessed NCS’s QA system 13 times. On 18 and 19 March, he ran a script designed to delete all 180 virtual servers in the system. The script was written to delete the servers one by one.
The following day, the NCS team realised that the system was inaccessible and tried unsuccessfully to troubleshoot the problem. They discovered that the servers had been deleted.
A police report was filed on 11 April 2023, and several IP addresses identified through an internal investigation were provided to the police. Kandula’s laptop was seized, and investigators found the scripts used to carry out the deletion.
The investigation found that he had searched Google for scripts to delete virtual servers, which he then used to code his own scripts. NCS suffered losses of S$917,832 as a result.