Karnataka's Maralu Mitra sand portal faces cyberattack threat; police register FIR
Police in Bengaluru have registered a First Information Report over a suspected website defacement attack targeting Maralu Mitra, Karnataka's online portal for booking sand loads, after a warning from the National Critical Information Infrastructure Protection Centre (NCIIPC).
The case was registered by the South-East CEN (Cyber, Economic and Narcotics) police. The portal, hosted at sand.karnataka.gov.in, is the state government's platform for managing sand booking operations and the public and official data linked to them.
According to the complaint, the NCIIPC — the central agency tasked with protecting India's critical information infrastructure — issued an alert about a possible defacement attack on the portal. A defacement attack typically involves an unauthorised party altering the visual content or front-end of a website, though investigators have not confirmed that any such change took place in this instance.
The government has expressed concern over the possibility of unauthorised access to, misuse, disclosure or alteration of the public and official data maintained on the software.
What is Maralu Mitra?
Maralu Mitra ("sand friend") is the state's digital interface for sand procurement. The system was introduced to bring sand booking, allotment and transport under a single online framework, with the stated aim of curbing illegal mining and making supply more transparent for builders, contractors and individual buyers. Because the platform holds records of bookings, payments, vehicle movements and allotments, any disruption or data compromise could affect both government records and members of the public who use the service.
The legal provisions invoked
The FIR has been registered under Sections 43, 66 and 66(C) of the Information Technology Act, 2000.
Section 43 deals with unauthorised access, downloading, copying or extraction of data from a computer resource, and provides for compensation to the affected person. Section 66 covers computer-related offences where acts referred to in Section 43 are done dishonestly or fraudulently. Section 66(C) deals with identity theft, defined as the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature.
Registering an FIR under these provisions indicates that investigators are treating the alert as a matter requiring a formal criminal inquiry. It does not, by itself, establish that an offence has been completed.
No confirmation of data breach, say police
Police said the available information does not establish whether any data was actually accessed, altered or leaked. The complaint raises concerns about a potential cyberattack based on the NCIIPC alert; whether the portal was in fact breached, and to what extent, is a matter that the investigation will need to determine.
The Maralu Mitra portal is one of several state government services that handle citizen data and payments. Alerts from the NCIIPC are routine in the sense that they are issued whenever a threat vector is detected against protected or monitored systems, and they are intended to prompt preventive action by the agency running the service.
Questions sent to the departments concerned about whether the portal was taken offline, whether users were notified, and what security audits are in place did not immediately elicit a response.
Readers using the portal are advised to rely on official communication from the state government regarding the status of the service. This report will be updated if further details emerge from the police, the government or the NCIIPC.
