KiranaPro has indicated that the breach resulted from internal actions rather than an external hack.

Initial claims were based on GitHub emails linking the incident to the former employee’s username, but further investigation is needed to confirm this and the company cannot rule out an external hack.

Last week, KiranaPro discovered its backend servers were inaccessible and its app code had been deleted from GitHub.

Co-founder and CEO Deepak Ravindran said they did not deactivate the employee’s account upon departure, allowing potential misuse.

A full forensic investigation is pending, and the team plans to brief its board, investors, and legal advisors.

Chief technology officer Saurav Kumar acknowledged that, due to the lack of a full-time HR department, the former employee’s access to GitHub and other accounts was never revoked.

The startup also temporarily lost access to its AWS account, which held customer data and transaction details.

🔗 Source: TechCrunch

🧠 Food for thought

1️⃣ Poor offboarding practices represent a critical but overlooked security vulnerability

KiranaPro’s failure to deactivate a former employee’s account highlights a common security blindspot among startups.

Their CTO explicitly acknowledged this failure, stating, “Employee offboarding was not being handled properly because there was no full-time HR,” revealing how basic security protocols are often neglected.

This reflects a broader pattern where overlooked vulnerabilities, rather than sophisticated attacks, are responsible for major breaches in India, with compromised credentials accounting for 16% of all cyber incidents 1.

The case demonstrates why proper account termination procedures are crucial, as 67% of victim companies experience multiple attacks, with cybercriminals often exploiting existing access points rather than creating new ones 2.

Indian organizations’ cybersecurity investments are projected to reach $4.5 billion by 2027. Yet, this incident shows how even basic security hygiene is frequently overlooked despite growing awareness 2.

2️⃣ Indian startups face unique cybersecurity challenges amid escalating threats