# Op-ed: Kudankulam leak shows nuclear cyber risk now lies with contractors

URL: https://upsc.help/current-affairs/2026-10-27/kudankulam-supply-chain-cyber-oped/
Date: 27 October 2026 (2026-10-27)
Source: The Hindu, Lead (Page 6)
UPSC papers: GS3
Publisher: upsc.help (Pratidin), free and open-source UPSC Civil Services current affairs. Not affiliated with UPSC. Every fact was checked against the source reports by a separate review before publishing.

**In one line:** A leak of Kudankulam project files from a contractor's hosted server shows that critical infrastructure must be secured across its whole supply chain, not just inside the plant.

An article on The Hindu's Lead page on 27 October argues that protecting critical infrastructure such as nuclear plants can no longer stop at the plant's fence. It starts from the Kudankulam Nuclear Power Project (KKNPP) leak reported in July 2026. The ransomware group World Leaks posted close to 19,000 files, totalling 14.3 GB, on the dark web, labelled as coming from the Reliance Group and online since 11 June. Reported contents included ventilation and cooling blueprints for Units 3 and 4, the layout of a common control room, vendor proposals, an approved supplier list and records of a 2024 joint inspection. Reliance Infrastructure, which won the contract for the project's common service facilities through a 2018 tender, confirmed a "partial breach" of data on a server hosted by Yotta, a third-party data centre.

The Nuclear Power Corporation of India Limited (NPCIL) said the material related only to "conventional balance-of-plant service facilities" and was "unconnected to nuclear safety or security systems". Russia's Rosatom supplies the reactors' core systems, and Units 3 and 4, under construction, are due to be operational by 2027. In 2019, malware linked to a North Korean hacker group was found on the plant's administrative network; NPCIL said plant systems were unaffected. The op-ed's point is that attackers no longer need to breach a reactor. They can target weaker contractors, cloud hosts and service providers that hold project data, and documents that look routine one by one can, when combined, reveal layouts, equipment, suppliers and possible access points.

India's framework has two main pillars. The National Critical Information Infrastructure Protection Centre (NCIIPC), set up under Section 70A of the Information Technology Act, 2000 and a unit of the National Technical Research Organisation, protects critical information infrastructure. CERT-In, under Section 70B, handles incident response, and its directions of 28 April 2022 require cyber incidents to be reported within six hours. The Digital Personal Data Protection Act, 2023 covers personal data, so technical drawings largely fall outside it. The op-ed calls for security standards, audit rights and breach-reporting duties in vendor contracts, regular third-party risk assessments in place of annual certificates, 'zero trust' access checks, sharing only essential data, and a national supply-chain cyber framework linking CERT-In, NCIIPC, sector regulators and operators.

## Prelims facts

- In July 2026 World Leaks posted close to 19,000 Kudankulam-related files (14.3 GB) taken from a Reliance server hosted by third-party data centre Yotta.
- NPCIL said the files concerned conventional balance-of-plant facilities and were unconnected to nuclear safety or security systems.
- NCIIPC, created under Section 70A of the IT Act, 2000 and notified on 16 January 2014, is a unit of NTRO and the nodal agency for critical information infrastructure.
- CERT-In's directions of 28 April 2022, issued under Section 70B(6), require cyber incidents to be reported within six hours and logs kept for 180 days in India.
- The op-ed argues that vendor contracts, third-party audits and data minimisation must extend security beyond the plant's perimeter.

## Quick recall

- **Which group claimed the Kudankulam-related leak in 2026?** The ransomware group World Leaks.
- **How many files and how much data were posted?** Close to 19,000 files totalling 14.3 GB.
- **Whose server did the data come from?** A Reliance server hosted by Yotta, a third-party data centre.
- **What did NPCIL say the files concerned?** Conventional balance-of-plant service facilities, unconnected to nuclear safety or security systems.
- **Legal basis and parent body of NCIIPC?** Section 70A of the IT Act, 2000; a unit of the National Technical Research Organisation.
- **Reporting deadline under CERT-In's 2022 directions?** Six hours from noticing or being alerted to an incident.
- **How did Stuxnet reach Iran's Natanz facility?** Through infected USB drives that crossed the air gap; it targeted Siemens controllers running centrifuges.
- **Who supplies the core systems of the Kudankulam reactors?** Russia's state-owned Rosatom.

## Prelims practice question

With reference to India's cybersecurity framework, consider the following statements:
1. The National Critical Information Infrastructure Protection Centre is a unit of the National Technical Research Organisation.
2. CERT-In's 2022 directions require cyber incidents to be reported within 24 hours of being noticed.
3. NCIIPC derives its legal basis from Section 70A of the Information Technology Act, 2000.
Which of the statements given above are correct?

(a) 1 and 2 only
(b) 2 and 3 only
(c) 1 and 3 only
(d) 1, 2 and 3

Answer: (c) 1 and 3 only. Statements 1 and 3 are correct: NCIIPC is an NTRO unit created under Section 70A, inserted by the 2008 amendment. Statement 2 is wrong: the 28 April 2022 directions require reporting within six hours.

## UPSC previous-year questions this connects to

- UPSC Mains 2022, GS3: What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (https://upsc.help/pyq/q343-different-elements-cyber-security-keeping-view-challenges/)
  How to use this story in the answer: Use the Kudankulam leak to show that India's framework covers operators but not yet the supply chain, and to propose specific reforms.
- UPSC Mains 2015, GS3: Discuss the advantage and security implication of cloud hosting of servers vis-a-vis in house machine based hosting for government business. (https://upsc.help/pyq/q351-advantage-security-implication-cloud-hosting-servers-vis-a-vis/)
  How to use this story in the answer: Cite the Kudankulam case as an example of the security risk when sensitive project data is hosted by third parties.

## Mains practice question

Critical infrastructure is now only as secure as its weakest contractor. Discuss with reference to recent incidents and suggest measures to strengthen supply-chain cybersecurity in India. (250 words)

### Model answer

Attacks on critical infrastructure increasingly enter through vendors rather than the facility itself. The July 2026 leak of close to 19,000 Kudankulam-related files from a contractor's server hosted by a third-party data centre shows the shift.

## Why contractors are the weak link
- **Wider perimeter:** engineering firms, cloud hosts and suppliers hold drawings, supplier lists and inspection records.
- **Aggregation risk:** routine documents combined can reveal layouts and access points, aiding reconnaissance and phishing.
- **Ransomware double extortion:** data is stolen and leaked, so confidentiality matters as much as uptime.
- **Precedent:** Stuxnet (2010) crossed an air gap into Iran's Natanz facility via infected USB drives.

## Existing framework and gaps
- **NCIIPC** (Section 70A, IT Act; NTRO unit) protects critical information infrastructure.
- **CERT-In** (Section 70B) directions of 28 April 2022 mandate reporting within six hours.
- **Gap:** the DPDP Act, 2023 covers personal data, not technical drawings, and accountability between operator, contractor and host is fragmented.
- NPCIL said the Kudankulam files were non-nuclear, but verifying such claims after a leak is hard.

## Measures
- Mandatory security clauses, audit rights and breach notification in vendor contracts.
- Continuous third-party risk assessments and red-team exercises instead of annual certificates.
- Zero-trust access, multi-factor authentication and network segmentation.
- Classify sensitive data; share only what is needed, for limited periods.
- A national supply-chain cyber framework linking CERT-In, NCIIPC, sector regulators and operators.

Securing the fence is no longer enough; India must secure the whole chain that builds and runs its critical assets.

## The basics

## Why this matters
Power plants, grids, telecom networks and banks run on computers. If they are hacked, the damage spreads far beyond one company. India calls such systems critical information infrastructure. The Kudankulam leak shows that the risk now sits not only inside the plant but across everyone who designs, builds and stores data for it.

## What happened at Kudankulam
A ransomware group posted close to 19,000 project files taken from a contractor's server hosted by a third-party data centre. The plant operator says the files concerned conventional, non-nuclear facilities. See Ransomware and double extortion.

## Why the fence is not enough

An 'air gap' means keeping control systems physically cut off from the internet. It helps, but it is not a guarantee: Stuxnet reached Iran's Natanz enrichment plant through infected USB drives.

## Who guards what in India
NCIIPC and CERT-In split the work. NCIIPC protects critical information infrastructure; CERT-In responds to incidents.

## What the op-ed proposes

The op-ed's lesson: an asset is only as safe as the least protected firm holding its secrets.

## Sources

- https://m.thewire.in/article/energy/ransomware-group-leaks-19000-kudankulam-files-from-reliance-server-npcil-denies-sensitive-breach/amp
- https://www.teiss.co.uk/news/npcil-denies-sensitive-data-breach-at-kudankulam-nuclear-plant-says-leaked-files-involve-only-conventional-systems-17839
- https://forumias.com/blog/beyond-kudankulams-fence-a-cybersecurity-challenge/
- https://nciipc.gov.in/about_us.html
- https://trilegal.com/knowledge_repository/2022-cert-in-directions-on-reporting-cyber-incidents/
- https://en.wikipedia.org/wiki/Stuxnet