17 - 07 - 2026

Kudankulam files surface on dark web as India probes leak at nuclear plant contractor

A cache of files linked to India’s Kudankulam Nuclear Power Plant has surfaced on the dark web, prompting a cybersecurity review of a breach that reportedly affected a Reliance Group contractor and raised fresh concerns over the digital security of critical infrastructure.

Ransomware group World Leaks claims to have stolen about 858,000 files from Anil Ambani’s Reliance Group, including nearly 19,000 files tied to Kudankulam, among them vendor proposals, inspection records and purported drawings of plant support systems, Reuters reported.

Reliance Infrastructure said the episode involved a “partial breach” of data on a server hosted by Yotta Data Services, which said it detected suspicious activity on May 29 and blocked the suspected ransomware execution. The files reportedly relate to non-nuclear “balance of plant” work for Kudankulam’s Unit 3 and Unit 4, which Reliance won in 2018, and officials have said the material does not appear to involve reactor safety or core security systems.

Still, cybersecurity experts warned that even conventional engineering documents can be useful to attackers because they can map who has access to a project, identify weak points in contractor networks and expose the systems surrounding a nuclear facility, according to media reports.

Ransomware attacks

The episode follows a separate World Leaks case involving Tata Group, which Reuters reported in June involved a ransom demand over confidential client designs, underscoring the group’s focus on large Indian industrial targets. India’s main cybersecurity agency CERT-In is reviewing the incident, while the Nuclear Power Corporation of India has been communicating with Reliance about the breach, according to a source cited in the reports.

A breach like the Kudankulam-linked leak tends to push cybersecurity policy in three directions at once: it raises pressure for tighter rules on contractors, stronger oversight of critical infrastructure, and faster incident disclosure. In sectors such as energy and nuclear power, policymakers usually respond by treating the breach not just as a technical failure, but as a governance problem across the whole supply chain.

First, it broadens the focus beyond the primary operator. Even if the reactors themselves are not compromised, leaked engineering files, vendor records and inspection documents can expose how access is structured around the project, which is why regulators often tighten third-party risk management, vendor audits and segmentation requirements after such incidents.

Second, it strengthens the case for mandatory reporting and quicker notification. The FTC has said effective breach detection and response can limit harm and help other agencies and affected parties take remedial action, and that logic carries over into critical infrastructure policy as governments try to prevent a single incident from becoming a wider security pattern.

Third, it encourages policymakers to treat cyber defense as part of industrial and national-security strategy rather than just IT hygiene. Reuters reported that India’s CERT-In is already reviewing the Kudankulam-related incident, and breaches involving sensitive infrastructure usually accelerate calls for tougher standards on data hosting, encryption, access logging and contractor accountability.

The broader policy lesson is that the most sensitive part of the breach may not be the files themselves but the map they create of a project’s ecosystem. Once attackers can see who works where, what systems are connected and which vendors sit in the chain, policymakers usually move toward a “zero trust” approach for critical infrastructure, with tighter controls on privileged access and better separation between project data and operational systems, according to the US Federal Trade Commission (FTC).

Venkatesh G