Indian grocery delivery startup KiranaPro has been hit by a major cyberattack that has rendered its app inoperable and resulted in a complete loss of customer data. The breach, discovered on May 26, has wiped out everything from the company’s app codebase to sensitive user information, including names, addresses, and payment details.
Founder Deepak Ravindran confirmed the incident to TechCrunch, describing it as a catastrophic security lapse that has brought the company’s operations to a standstill. Hackers reportedly gained unauthorized access to KiranaPro’s Amazon Web Services (AWS) and GitHub accounts—allegedly through credentials linked to a former employee.
The attackers managed to bypass two-factor authentication protocols and deleted all virtual machines (EC2 instances) powering the app. “Everything was gone,” Ravindran said, including years of backend development and operational data.
Launched in December 2024, KiranaPro had rapidly gained traction by offering a voice-assisted grocery ordering experience in regional languages including Hindi, Tamil, Malayalam, and English. The platform connected users to local kirana stores in over 50 cities, processing approximately 2,000 orders per day. The team had been preparing to double its operational footprint in the next 100 days before the breach derailed those plans.
KiranaPro is now working with GitHub’s security team to trace the attackers and is pursuing legal action against former employees who failed to return access credentials upon exit. The incident raises serious concerns about security governance in fast-scaling startups and the growing threat of insider-linked cyberattacks in India’s booming digital commerce ecosystem.
As of now, KiranaPro has not confirmed a timeline for restoring services, and users are being urged to remain vigilant in case their personal information is misused.
