Former Employee Sentenced for Deleting Virtual Servers, Costing Company S$918,000 (Ksh. 88,213,009.65)

An ex-employee in Singapore accessed his former company’s computer test systems and deleted 180 virtual servers, causing an estimated loss of S$918,000 (US$678,000).

Kandula Nagaraju, 39, received a two-year and eight-month jail sentence on Monday (June 10) for unauthorized access to computer material. Another charge was considered during sentencing.

Nagaraju’s contract with NCS was terminated in October 2022 due to poor performance, with his official last working day being November 16, 2022. Court documents revealed that Nagaraju felt “confused and upset” by his termination, believing he had contributed positively to NCS.

Incident Overview

From November 2021 to October 2022, Nagaraju was part of a 20-member team at NCS, a company providing information communication and technology services. This team managed the quality assurance (QA) computer system, which tested new software and programs before launch. According to NCS, the system was a “standalone test system” with no sensitive information.

After his termination, Nagaraju returned to India. Using his laptop and the administrator login credentials, he accessed the system six times between January 6 and January 17, 2023.

In February 2023, Nagaraju came back to Singapore for a new job. He rented a room from a former NCS colleague and used their Wi-Fi network to access NCS’ system again on February 23, 2023. During these unauthorized accesses, he wrote computer scripts to delete the servers.

In March 2023, he accessed NCS’ QA system 13 times. On March 18 and 19, he ran a script to delete 180 virtual servers one by one.

The next day, NCS’ team found the system inaccessible and discovered the servers had been deleted. An internal investigation led to a police report on April 11, 2023, and several IP addresses were handed over to the police.

Nagaraju’s laptop, seized by the police, contained the script used for the deletions. Investigations revealed he had searched online for scripts to delete virtual servers and used this information to write his own.

Despite knowing he was not authorized to access the system after his employment ended, Nagaraju proceeded with his actions, resulting in a loss of S$917,832 for NCS.