KiranaPro Crashes After Hackers Erase Entire System in Devastating Cyberattack

In a chilling reminder of cybersecurity vulnerabilities in India’s startup space, KiranaPro, a Bengaluru-based grocery delivery platform operating under the Open Network for Digital Commerce (ONDC), has been brought to a standstill after hackers wiped its servers and deleted its entire code base. The attackers reportedly gained access to the company's Amazon Web Services (AWS) infrastructure and GitHub repositories, deleting core systems and sensitive customer data, including names, addresses, and payment details.

The breach, discovered on May 26, is believed to have originated from access credentials left behind by a former employee. Suspicious login activity was recorded around May 24–25, and despite the use of multi-factor authentication via Google Authenticator, attackers managed to override security layers—possibly using malware or overlooked permissions. CEO Deepak Ravindran confirmed that the company no longer has root access and can only track remnants through IAM logs.

Founded in December 2024, KiranaPro had quickly scaled operations, serving 55,000 customers across 50 cities and processing 2,000 daily orders. A massive expansion to 100 cities was underway before the attack derailed operations. Though the app remains accessible, it currently cannot process any orders.

The company has approached GitHub for forensic support and is initiating legal action against former employees whose oversight may have contributed to the breach.

Backed by investors like Blume Ventures and supported by Olympian PV Sindhu, KiranaPro operated with a lean 15-member team. Experts warn that such early-stage startups often underestimate cybersecurity, relying heavily on cloud platforms without robust offboarding and credential management protocols.

This incident adds to a growing list of cyberattacks on global platforms like LastPass and Snowflake, reinforcing the urgent need for cybersecurity maturity in India’s digital economy. KiranaPro’s future—and that of its users—remains hanging in the balance.