Thousands of files linked to Kudankulam nuclear plant exposed in alleged ransomware breach

The reported leak of nearly 19,000 files linked to the Kudankulam Nuclear Power Plant in Tamil Nadu should set off alarm bells across the country’s security establishment. Even if the authorities are correct in asserting that the plant’s critical operational systems remain uncompromised, the incident cannot be dismissed as inconsequential. Nuclear installations are not ordinary infrastructure projects. Any breach involving them deserves the highest degree of scrutiny, transparency, and urgency. The official reassurance that the leaked files do not contain sensitive information relating to the reactors’ core systems is certainly comforting. The reactors are supplied by Russia’s Rosatom, and there is no evidence that their operational controls have been accessed. Yet, such assurances answer only part of the question. They do not explain how a ransomware group managed to obtain as much as 14.3 gigabytes of data in the first place. Nor do they establish with certainty that everything stolen has already been made public. Criminal syndicates dealing in ransomware are driven by profit, not publicity. It would be naïve to assume they have revealed every file in their possession.Supply Chain VulnerabilitiesThe breach reportedly originated from systems belonging to Reliance Infrastructure, a contractor engaged in the construction of Kudankulam’s Units 3 and 4, through servers hosted by a third-party data centre. This underlines a growing vulnerability in modern infrastructure projects. The weakest link is often not the principal installation but the extended network of contractors, vendors, and service providers. A cyberattack on one partner can expose an entire ecosystem. Even documents that do not concern reactor controls may prove valuable to hostile actors. Details about suppliers, layouts, support systems, contracts or insurance arrangements can help adversaries map vulnerabilities and identify points for future attacks. Cybersecurity experts have rightly warned that such information, when pieced together, can become an intelligence goldmine.Need For Stronger CybersecurityThe Kudankulam incident is also a reminder that India’s cyber preparedness remains inadequate. India ranks among the world’s worst-affected countries for data breaches, while surveys indicate that many organisations lack basic cyber hygiene. This is hardly reassuring for a nation rapidly expanding its digital and strategic infrastructure. Equally worrying is that this is not the first cyber scare involving Kudankulam. Malware linked to a North Korean hacking group was detected on the plant’s administrative network in 2019. While the operational systems remained unaffected then as well, repeated incidents point to persistent attempts to probe India’s critical infrastructure. The government must, therefore, treat this episode as a national security warning rather than a public relations challenge. Every contractor handling strategic projects should be subjected to rigorous cybersecurity audits, continuous monitoring, and strict compliance standards. In the digital age, safeguarding critical data is as important as protecting physical assets. Information in hostile hands can be be as dangerous as weapons themselves.

Purported blueprints of parts of India's largest plant exposed by World Leaks ransomware group, Reuters reports.

The Kudankulam Nuclear Power Plant in Tamil Nadu is central to Prime Minister Narendra Modi's ambitious plans to expand the country's atomic energy capacity.

Files linked to Kudankulam Nuclear Power Plant surfaced on the Dark Web after a reported ransomware incident. This explainer breaks down what was leaked, what it means, and what remains protected

Nuclear Power Corporation of India stated its core systems remain secure after a cyber incident. A ransomware group posted files related to the Kudankulam nuclear plant online. Reliance Group confirmed a partial data breach on a third-party provider's server. These leaked files are not connected to nuclear safety or security systems. The incident involved conventional balance of plant common service facilities.

A ransomware group has published thousands of files purportedly linked to the Kudankulam Nuclear Power Plant, India's largest nuclear facility, raising concerns over the security of sensitive infrastructure.The group, World Leaks, posted what it claimed were files sourced from Anil Ambani-led Reliance Group. The cache allegedly includes blueprints of parts of the plant, supplier information, meeting records, inspection reports, insurance documents and other project-related files, Reuters reports.Reuters reviewed the documents, dated between 2016 and mid-2025, but could not verify their authenticity.Reliance confirms partial breachReliance Group, one of the contractors involved in the Kudankulam project, acknowledged a "partial breach" of data stored on a server hosted by Indian data centre service provider Yotta. The company said it had informed the Government about the incident but did not disclose what information had been compromised.World Leaks uploaded around 19,000 files that appeared to be the most sensitive among about 858,000 Reliance-related files available on its website. The ransomware group typically publishes stolen corporate data after companies refuse to pay the demanded ransom. Its website is accessible only through a specialised browser.In June, World Leaks told Reuters it had demanded $1.5 million from Tata Group for stolen files containing confidential component designs of Apple and Tesla, adding that it published the data after Tata "ignored" its demand.Reliance Infrastructure secured a contract in 2018 to design and build infrastructure for Unit 3 and Unit 4 of the Kudankulam project. The two units, currently under construction, are expected to become operational by 2027 and together will add 2,000 megawatts of power generation capacity.Investigation underway as experts warn of risksThe Nuclear Power Corporation of India (NPCIL), which operates the country's nuclear power plants, is in contact with Reliance over the breach, while the Indian Computer Emergency Response Team (CERT-In) is investigating the matter, according to a source familiar with the developments.NPCIL Chairman Rajesh Veeraraghavan, CERT-In and the Government's main press office did not respond to Reuters' requests for comment. The Department of Atomic Energy declined to comment, while Prime Minister Narendra Modi's Office also did not respond.Yotta said it detected suspicious activity on May 29 on a server belonging to Reliance Infrastructure. According to the company, the activity was immediately stopped and the suspected ransomware execution was prevented. However, Reliance Infrastructure informed Yotta at the end of June that "external threat actors" had claimed a data breach.Yotta said it has not been able to verify the claims of the "threat actor" but has shared its technical findings with Reliance Infrastructure and continues to support the investigation.Sensitive documents allegedly exposedThe leaked documents do not appear to involve the nuclear reactors' core systems, which are supplied by Russia's state-owned Rosatom. However, they reportedly include blueprints for ventilation and cooling systems serving Unit 3 and Unit 4, along with what appears to be the complete floor layout of a common control room.The files also contain what appear to be vendor proposals, approved supplier lists, records of a 2024 joint inspection by NPCIL and Reliance, photographs of equipment, and an insurance policy allegedly covering losses of up to $112 million if either Unit 3 or Unit 4 were to suffer an act of terrorism.Nickolas Roth, Senior Director at the Nuclear Threat Initiative, warned the breach could pose a "serious" risk to the plant's safety.The files, if obtained by malicious actors, could potentially be used to map support systems, identify suppliers and locate weaknesses in the plant's security chain, researchers said.BMC Intensifies Crackdown On Unauthorised Schools; FIR Against 3 English-Medium Institutions In Chembur's VashinakaThey could "show an adversary not just who has access to the project but which systems that access reaches," said Nuclear Threat Initiative's Roth.Rising cyber threats in IndiaThe incident highlights growing cybersecurity challenges in India. According to cybersecurity company Surfshark, India ranked third globally last year for compromised accounts, with 28.9 million accounts affected, behind only the US and France.A report by the Data Security Council of India and cybersecurity firm Seqrite found that 73% of 204 organisations surveyed were "unaware if they have ever been attacked", while 57% lacked cyber hygiene practices.The Kudankulam Nuclear Power Plant has previously been linked to a cyber incident. In 2019, malware associated with a North Korean hacking group was detected on the plant's administrative network. At the time, NPCIL said the matter was investigated immediately and that the plant's operational systems were unaffected.