A massive Kudankulam nuclear plant data breach has put India’s largest atomic facility in the spotlight after ransomware group World Leaks posted nearly 19,000 files online.
The leaked cache includes purported blueprints of support systems, supplier lists, meeting records and insurance documents linked to the Kudankulam Nuclear Power Plant in Tamil Nadu. The incident has triggered urgent government reviews and raised questions about cybersecurity at sites critical to Prime Minister Narendra Modi’s nuclear expansion plans.
The files, totalling 14.3 gigabytes, appeared online on June 11 under the search term “KKNP”, the acronym for the plant. Independent cybersecurity researcher Rakesh Krishnan first alerted Reuters to the leak.
Reuters reviewed documents dated from 2016 to mid-2025 but could not independently verify their authenticity. The material does not appear to relate to reactor core systems, which are supplied by Russia’s state-owned Rosatom, but researchers warn that even support infrastructure details can be exploited.
Indian conglomerate Reliance Group confirmed a “partial breach” on a server hosted by third-party data centre provider Yotta. In a statement to Reuters, Reliance said the government had been informed. The company did not specify what data was taken. The breach is being examined by the Indian Computer Emergency Response Team, CERT-In, and the Nuclear Power Corporation of India has been in contact with Reliance about the incident.
World Leaks Ransomware Targets Reliance Group Server
World Leaks is a well-known ransomware group that has previously targeted Nike and India’s Tata Group. It typically publishes stolen corporate data after ransom demands are not met. Its site can only be accessed via a specialised browser and it did not respond to Reuters queries about the Reliance breach.
The 19,000 files appear to be the most sensitive subset of a much larger trove of 858,000 Reliance files posted on the group’s site. One Reliance subsidiary, Reliance Infrastructure, won a 2018 contract to design and build infrastructure for Kudankulam’s Unit 3 and Unit 4. Both units remain under construction and are scheduled to be operational by 2027, with a combined capacity of 2,000 megawatts.
According to Yotta, suspicious activity was detected on May 29 on a Reliance Infrastructure server it hosts. “The activity was immediately terminated and that the suspected ransomware execution was prevented,” Yotta said. It added that at the end of June, Reliance informed it of claims made by “external threat actors”. Yotta said it has shared its technical investigation with Reliance and is supporting an ongoing probe.
Security experts say the timing and scale are concerning. India ranks third globally for data breaches, with 28.9 million accounts compromised last year, according to Surfshark.
A 2025 report by the Data Security Council of India and Seqrite found that 73 percent of 204 organisations surveyed were “unaware if they have ever been attacked” and 57 percent lacked basic cyber hygiene.
India Nuclear Security Risk Grows As Sensitive Files Surface Online
The leaked material includes what appear to be blueprints for ventilation and cooling systems for Unit 3 and Unit 4, and what is described as the complete floor layout of a “common control room”.
Other files include vendor proposals, a list of approved suppliers, and records of a 2024 joint inspection by the Nuclear Power Corporation and Reliance, complete with equipment photos.
One document purports to show an insurance policy taken out by Reliance Infrastructure and the Nuclear Power Corporation that would pay $112 million if either Unit 3 or Unit 4 suffered an act of terrorism. While the files do not cover reactor cores, their release still presents risks.
Nickolas Roth, senior director at the Nuclear Threat Initiative, which advises governments on nuclear security, said the breach could pose a “serious” risk to the safety of the plant. “They could show an adversary not just who has access to the project but which systems that access reaches,” Roth said. In the wrong hands, such information could be used to map support systems, identify suppliers and look for weaknesses in the security chain.
The Nuclear Power Corporation of India, CERT-In and the Department of Atomic Energy did not respond to repeated requests for comment. Modi’s office also did not respond to Reuters queries.
This is not the first cyber incident at Kudankulam. In 2019, malware linked to a North Korean hacker group was found on the plant’s administrative network. At the time, the Nuclear Power Corporation said the matter was investigated immediately and that plant systems were not affected. The recurrence has intensified scrutiny of how contractors and data centres handle sensitive nuclear information.
Reliance Infrastructure’s exposure highlights a broader vulnerability. Many Indian companies rely on third-party hosting and have limited visibility into attacks. The Seqrite report noted that a majority of firms lack regular testing and incident response plans, making them easier targets for groups like World Leaks.
World Leaks has been aggressive in India. In June it told Reuters it had demanded $1.5 million from Tata Group over files containing confidential component designs for clients including Apple and Tesla. It said it published the data after Tata “ignored” the demand. The group’s playbook is consistent: breach, demand payment, and if refused, dump the data publicly.
Read also: Keir Starmer to issue social media curfew for teenagers in final online safety push
For Kudankulam, the immediate priority is containment and assessment. Officials must determine whether any of the leaked blueprints reveal access points or operational details that could aid sabotage. They must also audit supplier networks listed in the files, as those companies could become secondary targets.
The plant is central to India’s atomic energy ambitions. As the country’s largest nuclear facility, Kudankulam is meant to help meet rising power demand and reduce reliance on fossil fuels. Any perception that its data is insecure could affect public trust and international partnerships, especially with Rosatom on the reactor side.
Experts argue that technical fixes alone will not be enough. Stronger oversight of contractors, mandatory cyber audits for critical infrastructure, and better information sharing between CERT-In, plant operators and vendors are needed. Roth’s warning is blunt: even non-core documents can help an adversary plan.
For now, the files remain online. Reliance says it has notified authorities and is cooperating. Yotta says it acted quickly in May and continues to support the investigation. Whether the data is fully authentic is still being checked, but the volume and specificity have already forced a response at the highest levels.
The Kudankulam nuclear plant data breach is a reminder that critical infrastructure is only as secure as its weakest contractor. With India pushing to expand nuclear capacity, the pressure to close these gaps will only grow. According to reporting by Reuters, the government and Reliance are still working to verify the full scope of what was taken and what it means for plant security.
About The Author
