The KiranaPro data wipe incident raised serious questions about employee access and cloud security.In June 2025 the Indian grocery delivery startup lost access to important company data.The incident affected its GitHub code and Amazon Web Services (AWS) account.

Initially the company suspected an external attack.However CEO Deepak Ravindran later blamed a former employee.The company also admitted that it had not properly removed the former employee’s access.

What Caused The KiranaPro Data Wipe?

KiranaPro discovered that someone had erased its GitHub data including its application code.Furthermore the company temporarily lost access to its AWS account.

CEO Deepak Ravindran said a former employee had deleted important data.He shared GitHub emails that appeared to connect the account activity to that employee.

However the company had not completed a full forensic investigation.Therefore it could not completely rule out third-party access through the former employee’s account.

Ravindran also admitted that the company had not performed a complete security review.He said the investigation would require checks of devices account activity and company systems.

KiranaPro’s Employee Access And Security Failures

One major problem involved employee offboarding.KiranaPro admitted that it had not removed the former employee’s access after their departure.

Additionally CTO Saurav Kumar said the company lacked a full-time HR department.As a result the business did not handle employee exits properly.

This mistake created a serious security risk.Former employees should never retain access to company repositories, cloud accounts or internal systems.

Moreover companies should use multi-factor authentication (MFA) and review account permissions regularly.These steps can reduce the risk of unauthorized access.

How Did KiranaPro Recover Its Data?

Fortunately KiranaPro managed to restore its GitHub data using a backup from an employee.The company also regained access to its AWS account.

According to Ravindran the customer data and transaction records remained unchanged.He also said the company had no evidence that an outside party downloaded customer information.

However the company could not clearly explain how someone accessed its AWS account.This raised further