The Nuclear Power Corporation of India Limited (NPCIL) stated on Wednesday that the alleged data leak related to the Kudankulam project pertains exclusively to conventional Balance of Plant (BoP) auxiliary equipment, not to nuclear safety or protection systems.
This statement followed a report by the news agency Reuters that the hacker group World Leaks had posted over 19,000 confidential files concerning the Kudankulam Nuclear Power Plant in Tamil Nadu on the dark web.
NPCIL clarified that the contract for the Engineering, Procurement, and Construction (EPC) of the general services package – auxiliary equipment (BoP) – was awarded to Reliance Infrastructure Ltd. in 2018 through a public tender. The company emphasized that during this tender, NPCIL provided potential participants with preliminary drawings and technical specifications.
Based on this data and project requirements, the EPC contractor, Reliance Infrastructure Ltd., developed detailed engineering drawings after consulting with the respective Original Equipment Manufacturers (OEMs). These designs, which complied with the technical requirements, were approved by NPCIL after verification.
According to NPCIL, the scope of the EPC contract covers the design, procurement, supply, construction, and commissioning of general service facilities. It was added that these facilities are ordinary in nature, similar to those used in thermal power plants and other processing industries, and are not connected to nuclear safety or protection systems.
In its statement, NPCIL reiterated that the information allegedly available publicly relates only to conventional auxiliary Balance of Plant (BoP) facilities and has no connection to any systems or information related to nuclear safety or protection.
The documents analyzed by Reuters include engineering plans for ventilation and cooling systems, layouts of general control rooms, equipment inspection reports, supplier lists, vendor proposals, meeting minutes, and insurance policies. Reuters examined these documents, dated from 2016 to mid-2025, but could not confirm their authenticity.
These documents primarily relate to Blocks 3 and 4 of the Kudankulam plant, which are currently under construction and are expected to begin operation by 2027. They apparently lack design solutions for the main nuclear reactor systems supplied by the state Russian company Rosatom.
A ransomware group has published thousands of files allegedly related to India's largest nuclear power plant, Kudankulam. Experts warn that this could pose a 'serious' risk to the facility's security.
The hacker group World Leaks posted over 19,000 confidential documents concerning the Kudankulam Nuclear Power Plant in Tamil Nadu on the dark web. These documents are part of a larger set of approximately 858,000 files reportedly stolen from Reliance Group, one of the project's contractors.
Reliance Group confirmed a 'partial breach' of data on a server hosted by the third-party Indian data center Yotta. The company informed Reuters that the government was notified but did not disclose which specific data was compromised.
Reuters examined the leaks, dated from 2016 to mid-2025, but could not verify their authenticity. According to reports, the files include engineering drawings of ventilation and cooling systems, floor plans of the main control room, equipment inspection reports, supplier lists, vendor proposals, meeting minutes, and insurance policies.
These documents primarily relate to Blocks 3 and 4 of the Kudankulam plant, which are currently under construction and are planned for commissioning by 2027. Apparently, they do not contain designs for the main nuclear reactor systems supplied by the state Russian company Rosatom.
Nicholas Roth, Senior Director at the Nuclear Threat Initiative, stated that this leak could present a 'serious' risk to the plant's security. He told Reuters that attackers could reveal an adversary not only who has access to the project but also to which systems that access extends.
Despite the lack of evidence compromising the operational reactor systems, cybersecurity experts believe the obtained information could be valuable to hostile actors. Attackers could potentially exploit vulnerabilities in associated infrastructure or third-party suppliers.
According to a source familiar with the matter, the investigation into the breach is being conducted by India's Computer Emergency Response Team in collaboration with the Atomic Energy Corporation of India. Yotta, the data center provider, stated that it detected suspicious activity on the server on May 29, and the alleged ransomware execution was prevented; however, Reliance Infrastructure later notified the company about the data breach claims.
Neither the Ministry of Atomic Energy nor the Prime Minister's Office publicly commented on the investigation conducted by Reuters. World Leaks, previously targeting Tata Group and Nike, did not respond to requests for comment.
This incident comes amid growing concerns over the cybersecurity of India's critical infrastructure. According to cybersecurity firm Surfshark, 28.9 million compromised accounts were registered in India last year, making the country one of the most affected by data leaks globally. Furthermore, a recent industry survey showed that 73% of surveyed Indian organizations 'do not know if they have been attacked,' and 57% do not adhere to cybersecurity hygiene practices.
