Op-ed: Kudankulam leak shows nuclear cyber risk now lies with contractors
In one line: A leak of Kudankulam project files from a contractor's hosted server shows that critical infrastructure must be secured across its whole supply chain, not just inside the plant.
Published 27 October 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
An article on The Hindu's Lead page on 27 October argues that protecting critical infrastructure such as nuclear plants can no longer stop at the plant's fence. It starts from the Kudankulam Nuclear Power Project (KKNPP) leak reported in July 2026. The ransomware group World Leaks posted close to 19,000 files, totalling 14.3 GB, on the dark web, labelled as coming from the Reliance Group and online since 11 June. Reported contents included ventilation and cooling blueprints for Units 3 and 4, the layout of a common control room, vendor proposals, an approved supplier list and records of a 2024 joint inspection. Reliance Infrastructure, which won the contract for the project's common service facilities through a 2018 tender, confirmed a "partial breach" of data on a server hosted by Yotta, a third-party data centre.
The Nuclear Power Corporation of India Limited (NPCIL) said the material related only to "conventional balance-of-plant service facilities" and was "unconnected to nuclear safety or security systems". Russia's Rosatom supplies the reactors' core systems, and Units 3 and 4, under construction, are due to be operational by 2027. In 2019, malware linked to a North Korean hacker group was found on the plant's administrative network; NPCIL said plant systems were unaffected. The op-ed's point is that attackers no longer need to breach a reactor. They can target weaker contractors, cloud hosts and service providers that hold project data, and documents that look routine one by one can, when combined, reveal layouts, equipment, suppliers and possible access points.
India's framework has two main pillars. The National Critical Information Infrastructure Protection Centre (NCIIPC), set up under Section 70A of the Information Technology Act, 2000 and a unit of the National Technical Research Organisation, protects critical information infrastructure. CERT-In, under Section 70B, handles incident response, and its directions of 28 April 2022 require cyber incidents to be reported within six hours. The Digital Personal Data Protection Act, 2023 covers personal data, so technical drawings largely fall outside it. The op-ed calls for security standards, audit rights and breach-reporting duties in vendor contracts, regular third-party risk assessments in place of annual certificates, 'zero trust' access checks, sharing only essential data, and a national supply-chain cyber framework linking CERT-In, NCIIPC, sector regulators and operators.
Prelims facts
- In July 2026 World Leaks posted close to 19,000 Kudankulam-related files (14.3 GB) taken from a Reliance server hosted by third-party data centre Yotta.
- NPCIL said the files concerned conventional balance-of-plant facilities and were unconnected to nuclear safety or security systems.
- NCIIPC, created under Section 70A of the IT Act, 2000 and notified on 16 January 2014, is a unit of NTRO and the nodal agency for critical information infrastructure.
- CERT-In's directions of 28 April 2022, issued under Section 70B(6), require cyber incidents to be reported within six hours and logs kept for 180 days in India.
- The op-ed argues that vendor contracts, third-party audits and data minimisation must extend security beyond the plant's perimeter.
Quick recall
- Which group claimed the Kudankulam-related leak in 2026?
- The ransomware group World Leaks.
- How many files and how much data were posted?
- Close to 19,000 files totalling 14.3 GB.
- Whose server did the data come from?
- A Reliance server hosted by Yotta, a third-party data centre.
- What did NPCIL say the files concerned?
- Conventional balance-of-plant service facilities, unconnected to nuclear safety or security systems.
- Legal basis and parent body of NCIIPC?
- Section 70A of the IT Act, 2000; a unit of the National Technical Research Organisation.
- Reporting deadline under CERT-In's 2022 directions?
- Six hours from noticing or being alerted to an incident.
- How did Stuxnet reach Iran's Natanz facility?
- Through infected USB drives that crossed the air gap; it targeted Siemens controllers running centrifuges.
- Who supplies the core systems of the Kudankulam reactors?
- Russia's state-owned Rosatom.
Prelims practice question
With reference to India's cybersecurity framework, consider the following statements:
1. The National Critical Information Infrastructure Protection Centre is a unit of the National Technical Research Organisation.
2. CERT-In's 2022 directions require cyber incidents to be reported within 24 hours of being noticed.
3. NCIIPC derives its legal basis from Section 70A of the Information Technology Act, 2000.
Which of the statements given above are correct?
- 1 and 2 only
- 2 and 3 only
- 1 and 3 only
- 1, 2 and 3
Show answer
Answer: (c) 1 and 3 only. Statements 1 and 3 are correct: NCIIPC is an NTRO unit created under Section 70A, inserted by the 2008 amendment. Statement 2 is wrong: the 28 April 2022 directions require reporting within six hours.
Use this in UPSC Mains: previous-year questions
Recurring theme: Cyber security of critical infrastructure and India's institutional response
- How to use this
Use the Kudankulam leak to show that India's framework covers operators but not yet the supply chain, and to propose specific reforms.
- In 2026, close to 19,000 Kudankulam-related files were leaked from a contractor's server hosted by a third-party data centre, Yotta.
- NCIIPC (Section 70A, IT Act) and CERT-In's six-hour reporting rule of 2022 exist, but no binding framework covers every vendor.
- Reforms: vendor security clauses and audit rights, continuous third-party risk checks, zero-trust access and data minimisation.
- How to use this
Cite the Kudankulam case as an example of the security risk when sensitive project data is hosted by third parties.
- Reliance confirmed a partial breach of data on a server hosted by Yotta; the files included blueprints and supplier lists for Kudankulam Units 3 and 4.
- Hosting contracts should carry security standards, audit rights and breach notification.
Mains practice question
Critical infrastructure is now only as secure as its weakest contractor. Discuss with reference to recent incidents and suggest measures to strengthen supply-chain cybersecurity in India. (250 words)
Model answer
Attacks on critical infrastructure increasingly enter through vendors rather than the facility itself. The July 2026 leak of close to 19,000 Kudankulam-related files from a contractor's server hosted by a third-party data centre shows the shift.
Why contractors are the weak link
- Wider perimeter: engineering firms, cloud hosts and suppliers hold drawings, supplier lists and inspection records.
- Aggregation risk: routine documents combined can reveal layouts and access points, aiding reconnaissance and phishing.
- Ransomware double extortion: data is stolen and leaked, so confidentiality matters as much as uptime.
- Precedent: Stuxnet (2010) crossed an air gap into Iran's Natanz facility via infected USB drives.
Existing framework and gaps
- NCIIPC (Section 70A, IT Act; NTRO unit) protects critical information infrastructure.
- CERT-In (Section 70B) directions of 28 April 2022 mandate reporting within six hours.
- Gap: the DPDP Act, 2023 covers personal data, not technical drawings, and accountability between operator, contractor and host is fragmented.
- NPCIL said the Kudankulam files were non-nuclear, but verifying such claims after a leak is hard.
Measures
- Mandatory security clauses, audit rights and breach notification in vendor contracts.
- Continuous third-party risk assessments and red-team exercises instead of annual certificates.
- Zero-trust access, multi-factor authentication and network segmentation.
- Classify sensitive data; share only what is needed, for limited periods.
- A national supply-chain cyber framework linking CERT-In, NCIIPC, sector regulators and operators.
Securing the fence is no longer enough; India must secure the whole chain that builds and runs its critical assets.
The basics
Why this matters
Power plants, grids, telecom networks and banks run on computers. If they are hacked, the damage spreads far beyond one company. India calls such systems critical information infrastructure. The Kudankulam leak shows that the risk now sits not only inside the plant but across everyone who designs, builds and stores data for it.
What happened at Kudankulam
A ransomware group posted close to 19,000 project files taken from a contractor's server hosted by a third-party data centre. The plant operator says the files concerned conventional, non-nuclear facilities. See Ransomware and double extortion.
Why the fence is not enough
- 1OperatorRuns the plant; protects control systems
- 2ContractorsHold drawings, layouts and inspection records
- 3SuppliersHold equipment and vendor details
- 4Data centres and cloud hostsStore contractors' data on their servers
An 'air gap' means keeping control systems physically cut off from the internet. It helps, but it is not a guarantee: Stuxnet reached Iran's Natanz enrichment plant through infected USB drives.
Who guards what in India
NCIIPC and CERT-In split the work. NCIIPC protects critical information infrastructure; CERT-In responds to incidents.
- Section 70A of the IT Act, 2000
- Notified 16 January 2014
- Unit of NTRO
- Protects critical information infrastructure
- Section 70B of the IT Act, 2000
- National incident response agency
- 2022 directions: report within six hours
- Logs kept for 180 days in India
What the op-ed proposes
- 1ContractsSecurity standards, audit rights, liability and breach notification for vendors
- 2AssessmentRegular third-party risk checks and red-team drills, not annual certificates
- 3AccessZero trust: verify every request, use multi-factor authentication
- 4DataClassify sensitive files; share only what is essential, for limited periods
- 5CoordinationA national framework linking CERT-In, NCIIPC, regulators and operators
The op-ed's lesson: an asset is only as safe as the least protected firm holding its secrets.
Go deeper
Why it matters for UPSC
Cyber security, critical infrastructure and nuclear energy are GS3 staples. This op-ed gives a fresh Indian example and a clear set of reforms for answers on cyber threats.
The core idea
Critical facilities are guarded by NCIIPC and CERT-In and by isolating control systems. But contractors, suppliers and data centres now hold sensitive project data. Groups using Ransomware and double extortion target these weaker links. Isolation alone also failed in the famous case of Stuxnet. The answer the op-ed offers is supply-chain security written into contracts and checked continuously.
Numbers and dates to remember
- Close to 19,000 files, 14.3 GB, online since 11 June 2026; NPCIL statement on 15 July 2026.
- Yotta detected suspicious activity on 29 May 2026.
- NCIIPC notified on 16 January 2014 under Section 70A.
- CERT-In directions of 28 April 2022: six-hour reporting, 180-day logs.
- Kudankulam Units 3 and 4 due by 2027; planned park of 6,000 MW.
Where to go next
- NCIIPC and CERT-In: India's two main cyber agencies.
- Ransomware and double extortion: how the leak happened.
- Stuxnet: why air gaps are not enough.
Go deeper: how serious was the leak?
Reasons for reassurance:
- NPCIL said the files concerned conventional balance-of-plant facilities, unconnected to nuclear safety or security systems, and Reuters found they did not appear to cover the reactors' core systems, which Rosatom supplies.
- In the 2019 incident, malware reached only the administrative network, and NPCIL said plant systems were unaffected.
Reasons for concern:
- Blueprints, a control room layout, supplier lists and inspection records can, together, help an adversary plan reconnaissance or social engineering, as the op-ed argues.
- The data sat with a contractor and a hosting firm, outside the operator's direct control, showing fragmented accountability.
- Groups using Ransomware and double extortion publish what they steal, and claims about what was taken are hard to verify.
- Stuxnet showed that isolated industrial systems can still be reached.
Policy gaps: NCIIPC and CERT-In cover protection and incident response, but neither sets binding security terms for every contractor and host. The DPDP Act, 2023 covers personal data, not technical drawings.
Reforms the op-ed suggests: security clauses and audit rights in contracts, continuous third-party risk checks, zero-trust access, data minimisation, and a national supply-chain cyber framework with clear incident roles.
NCIIPC and CERT-In
India's two main cyber agencies.
In one line: NCIIPC protects India's critical information infrastructure, while CERT-In is the national agency for responding to cyber incidents.
NCIIPC
The National Critical Information Infrastructure Protection Centre was created under Section 70A of the Information Technology Act, 2000, inserted by the 2008 amendment, through a notification of 16 January 2014. It is a unit of the National Technical Research Organisation and the nodal agency for the protection of critical information infrastructure.
CERT-In
The Indian Computer Emergency Response Team works under Section 70B. Its directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government bodies to report cyber incidents within six hours and keep logs for 180 days in India.
Why it is in the news
The op-ed wants both agencies, sector regulators and operators tied into one supply-chain security framework.
Where to go next
Ransomware and double extortion
How the Kudankulam leak happened.
In one line: Ransomware is malicious software used to lock or steal a victim's data for money, and double extortion adds the threat of publishing stolen data.
How it works
Attackers get in through stolen passwords, phishing or weak remote access, copy data, and often try to encrypt systems. If the victim does not pay, they leak the data on dark web sites. So even a victim that restores its systems from backups still faces exposure.
In this case
World Leaks posted files labelled as Reliance Group data. Yotta said it detected suspicious activity on 29 May 2026 and stopped an attempted ransomware execution. In June 2026 the same group said it had sought $1.5 million from the Tata Group and published data after Tata refused to pay.
Where to go next
Stuxnet
Why air gaps are not enough.
In one line: Stuxnet was a computer worm, uncovered in June 2010, that is widely believed to have damaged centrifuges at Iran's Natanz uranium enrichment facility.
How it worked
It targeted Siemens programmable logic controllers, the small computers that run industrial machines, and attacked only systems driving motors at speeds typical of gas centrifuges. It reached isolated networks through infected USB drives, crossing the 'air gap' that was supposed to protect them.
Why it matters
Stuxnet showed that physically isolated control systems can still be attacked, and that cyber weapons can cause physical damage.
Why it is in the news
It illustrates the Kudankulam op-ed's argument that perimeter defence is not enough for critical facilities.
Where to go next
Take the 27 October 2026 quiz: 30 Prelims-style questions with answers