SINGAPORE (CNA) – After being dismissed, an upset employee hacked into his former company’s computer systems, deleting 180 virtual servers and causing approximately SGD918,000 (USD678,000) in damages.
Kandula Nagaraju, 39, received a two-year and eight-month jail sentence on June 10 for unauthorised computer access. An additional charge was considered during sentencing.
Kandula’s contract with NCS was terminated in October 2022 for poor performance, with his official last working day being November 16, 2022. Feeling “confused and upset,” he believed he had contributed significantly to NCS.
Upon leaving NCS, Kandula returned to India without securing another job in Singapore.
From November 2021 to October 2022, he was part of a 20-member team responsible for the quality assurance (QA) computer system at NCS, a company providing information communication and technology services. This system, comprising about 180 virtual servers, was used to test new software and programs without storing sensitive data.
After his termination, Kandula used his laptop to gain unauthorised access to the QA system six times between January 6 and January 17, 2023, using administrator login credentials. Upon returning to Singapore with a new job in February 2023, he accessed the system once more using a former colleague’s Wi-Fi network on February 23, 2023.
During these unauthorised accesses, Kandula wrote scripts to test their capability to delete the servers. Between March 18 and 19, 2023, he accessed the system 13 times, running a script that sequentially deleted all 180 virtual servers. The NCS team discovered the issue the following day but couldn’t resolve it, leading to the realisation that the servers had been deleted.
A police report was filed on April 11, 2023, and the investigation revealed several IP addresses connected to the breach. Kandula’s laptop, seized by the police, contained the script used for the deletions.
Investigations also showed he had searched online for scripts to delete virtual servers, which he then adapted for his use. Despite knowing he was unauthorised to access the system post-employment, Kandula proceeded, resulting in NCS’s substantial financial loss of SGD917,832.
