Fired Employee Deletes Company Servers Worth Rp 16 Billion

A young man from India has been sentenced to prison after he deleted 180 virtual servers belonging to his former employer, a company providing information, communication, and technology services, resulting in a loss of approximately US$918,000 (Rp 16.4 billion). The perpetrator, identified as Kandula, committed the crime out of resentment after being dismissed from his job at NCS in October 2022 due to poor performance. He officially ended his employment on 16 November 2022. Court documents revealed that Kandula was confused and upset by the termination, as he believed he had performed well and made positive contributions to the company. Following his dismissal, he no longer had employment in Singapore and returned to his hometown in India. Prior to his termination, Kandula had been part of a 20-member team managing the quality assurance (QA) computer system at NCS from November 2021 to October 2022. This system was used to test new software and programmes before their official launch. NCS confirmed that the compromised system was a standalone testing environment containing 180 virtual servers and did not store any sensitive information. Despite returning to India, Kandula’s resentment persisted. Using his personal laptop, he illegally accessed the NCS system six times between 6 and 17 January 2023, using administrator login credentials. He returned to Singapore in February 2023 to seek new employment and stayed in a room belonging to a former colleague. Using the Wi-Fi network there, he accessed the system again on 23 February 2023. During these two months of unauthorised access, Kandula wrote and tested computer scripts on Google to determine if they could be used to delete servers. The attack culminated in March 2023 when, after accessing the QA system 13 times, he executed the scripts on 18 and 19 March, systematically deleting all 180 virtual servers one by one. The following day, the NCS IT team found the system inaccessible. After unsuccessful troubleshooting attempts, they discovered that all the servers had been deleted. The case was reported to the police on 11 April 2023, after an internal investigation identified several suspicious IP addresses. Police subsequently seized Kandula’s laptop and found evidence of the scripts used to carry out the server deletion.