By Elsie Kamsiyochi
A major cybersecurity incident has raised fresh concerns over the protection of critical infrastructure in India after thousands of files reportedly linked to the Kudankulam Nuclear Power Plant were exposed online following an alleged ransomware attack. The leaked documents, which surfaced on the dark web, are said to include engineering blueprints, supplier information, inspection records, meeting minutes, insurance documents, and other sensitive project-related files connected to the country’s largest nuclear power facility.
The Kudankulam Nuclear Power Plant, located in the southern state of Tamil Nadu, plays a vital role in India’s long-term strategy to expand nuclear energy production and meet the country’s growing electricity demands. The facility is central to Prime Minister Narendra Modi’s plans to significantly increase India’s nuclear power capacity over the coming years, making any security incident involving the project a matter of national importance.
The ransomware group known as World Leaks has claimed responsibility for publishing the documents, labeling them as data obtained from Reliance Group, one of the contractors involved in the construction and development of the Kudankulam project. Cybersecurity researcher Rakesh Krishnan, who first alerted Reuters to the breach, said nearly 19,000 files totaling approximately 14.3 gigabytes have been publicly available since June 11. The files reportedly represent only a portion of more than 858,000 Reliance-related documents posted by the hacking group.
Reuters reviewed many of the leaked files but could not independently verify whether they are authentic. The documents appear to span nearly a decade, covering the period from 2016 through the middle of 2025. Among the material are purported layouts of ventilation and cooling systems, floor plans for a common control room, equipment inspection reports, vendor proposals, approved supplier lists, meeting records, and insurance policies associated with the construction of Units 3 and 4 of the nuclear plant.
Reliance Group acknowledged that a “partial breach” had occurred involving data stored on servers hosted by Indian data center provider Yotta. The company stated that the incident had been reported to the Indian government but did not specify exactly what information had been compromised. Reliance emphasized that investigations are ongoing to determine the full scope of the breach.
Yotta confirmed that it detected suspicious activity on one of its hosted servers on May 29. According to the company, its security systems immediately terminated the suspicious activity and prevented the ransomware from executing successfully. However, weeks later, Reliance Infrastructure informed Yotta that external threat actors were claiming to possess stolen company data. Yotta said it has been unable to independently verify those claims but has provided the results of its technical investigation to Reliance and continues to support the ongoing inquiry.
Indian authorities have also begun examining the incident. Sources familiar with the matter said the Nuclear Power Corporation of India has been coordinating with Reliance while the Indian Computer Emergency Response Team (CERT-In), the country’s primary cybersecurity agency, investigates the reported breach. Officials from the Nuclear Power Corporation, the Department of Atomic Energy, and the Prime Minister’s Office have not publicly commented on the matter.
Security experts warn that even if the leaked documents do not contain information relating directly to the nuclear reactors themselves, they could still present significant security risks. The reactor systems at Kudankulam are supplied by Russia’s state-owned Rosatom and are not believed to be included in the leaked material. However, infrastructure layouts, contractor details, supplier information, and engineering drawings could potentially allow malicious actors to better understand the facility’s support systems and identify possible vulnerabilities.
Nickolas Roth, a senior director at the Nuclear Threat Initiative, said documents of this nature could help adversaries map operational systems, identify organizations involved in the project, and determine how access to critical infrastructure is managed. Such information could potentially increase cybersecurity and physical security risks if exploited by sophisticated attackers.
Among the documents reportedly exposed is an insurance policy indicating that Reliance Infrastructure and the Nuclear Power Corporation secured coverage worth approximately $112 million for Units 3 and 4 against terrorism-related incidents. Other files appear to document joint inspections, equipment reviews, construction progress, and technical assessments carried out throughout the project.
The attack also highlights India’s growing cybersecurity challenges. According to cybersecurity firm Surfshark, India ranked third globally last year for the number of compromised accounts, behind only the United States and France, with nearly 29 million accounts affected. Separate industry research has found that many Indian organizations remain underprepared for cyberattacks, with a majority lacking adequate cybersecurity practices or even awareness of previous attacks targeting their systems.
This is not the first cybersecurity concern involving the Kudankulam Nuclear Power Plant. In 2019, malware linked to a North Korean hacking group was discovered on the plant’s administrative network. Authorities at the time stated that operational systems were unaffected and that the incident had been contained without disrupting plant operations.
The latest breach underscores the increasing threat ransomware groups pose to organizations responsible for critical infrastructure around the world. While investigators continue working to determine the authenticity of the leaked files and assess any potential damage, the incident is expected to intensify calls for stronger cybersecurity protections across India’s energy and nuclear sectors, where safeguarding sensitive operational information has become more important than ever.
Source Reuters
Original article
Comments