techend
By Ariz Riaz :
A ransomware group has published thousands of files allegedly linked to India’s Kudankulam Nuclear Power Plant, raising fresh concerns over cybersecurity at critical national infrastructure.
The group, known as World Leaks, claims to have stolen and released a large cache of documents associated with the Kudankulam Nuclear Power Plant in Tamil Nadu, India’s largest nuclear facility. The leaked material reportedly includes engineering blueprints, supplier records, inspection reports and insurance documents connected to contractor Reliance Infrastructure.
Reliance confirmed that a cybersecurity incident had affected a server hosted by third-party data centre provider Yotta, although it did not disclose the exact nature or extent of the compromised data. The company said the Indian government had been informed and that the matter was under investigation.
According to Reuters, which reviewed portions of the leaked material, the documents span the period from 2016 to mid-2025. While the news agency said it could not independently verify the authenticity of the files, the dataset reportedly contains engineering drawings, meeting records, equipment assessments and insurance policies.
Of the approximately 858,000 files attributed to Reliance Infrastructure on the World Leaks website, around 19,000 were identified as particularly sensitive. Some of the leaked documents reportedly relate to the construction of Units 3 and 4, which are expected to become operational by 2027 and add a combined 2,000 megawatts of electricity generation capacity.
The Nuclear Power Corporation of India (NPCIL), which operates the country’s nuclear facilities, is reportedly working with Reliance Infrastructure while India’s Computer Emergency Response Team (CERT-In) examines the incident.
Yotta said it detected suspicious activity on a Reliance Infrastructure server on 29 May and stopped the activity before ransomware could be executed. However, Reliance later informed the company that external threat actors had claimed to possess stolen data. Yotta said it could not independently verify those claims but had shared its findings with investigators.
The Department of Atomic Energy and the Prime Minister’s Office did not publicly comment on the reported breach.
Experts say the leaked files do not appear to include information related to the plant’s reactor systems, which are supplied by Russia’s state-owned nuclear company Rosatom. Instead, the documents reportedly contain engineering layouts for ventilation and cooling systems, control room floor plans, vendor information and records of inspections.
Researchers warn that even if reactor operations remain unaffected, such information could help cybercriminals or hostile actors identify contractors, understand support systems and target weaker points within the wider supply chain.
Nickolas Roth, Senior Director at the Nuclear Threat Initiative, said the exposure of supplier records and infrastructure documents could pose security risks by revealing how the facility operates beyond its core reactor systems. Such information, he noted, may assist attackers in mapping access points and identifying organisations connected to sensitive projects.
The incident comes as cyberattacks against critical infrastructure continue to increase worldwide. According to cybersecurity company Surfshark, India ranked third globally for data breaches last year, with 28.9 million user accounts reportedly compromised. Separate research by the Data Security Council of India and cybersecurity firm Seqrite found that many organisations remain poorly prepared for cyber threats, with a significant number lacking basic cybersecurity practices.
The Kudankulam incident is not the first cyber-related security concern involving the facility. In 2019, malware linked to a North Korean hacking group was detected on the plant’s administrative network. At the time, the Nuclear Power Corporation of India said operational reactor systems had not been affected.
While investigators continue examining the latest incident, cybersecurity experts say it underscores the growing importance of protecting not only nuclear facilities but also the wider network of contractors, suppliers and digital infrastructure that support them.
About The Author
