India's largest nuclear power facility has fallen victim to a significant cyber attack, with hackers posting thousands of confidential files online in what security experts warn could undermine the safety of the plant and the broader regional energy landscape. The Kudankulam Nuclear Power Plant in Tamil Nadu, central to Prime Minister Narendra Modi's plan to substantially increase India's nuclear energy generation, became the latest target of World Leaks, a known ransomware operation that has previously compromised major corporations including Nike and India's Tata Group. The breach represents a serious vulnerability in a critical infrastructure project that is intended to play a pivotal role in meeting South Asia's growing energy demands.
According to reports reviewed by international news agencies, the ransomware group uploaded approximately 19,000 highly sensitive files originating from Reliance Group, one of the primary contractors working on the Kudankulam facility. Reliance Infrastructure, a subsidiary of Anil Ambani's conglomerate, holds the contract to design and construct infrastructure for Units 3 and 4 of the plant—two of the facility's expansion units scheduled to commence operations by 2027 and collectively deliver 2,000 megawatts of power generation capacity. The company acknowledged a partial data breach through a server operated by Yotta, a third-party Indian data centre service provider, though it refrained from specifying which particular information had been compromised.
The scale and nature of the exposed materials are deeply troubling from a security perspective. While the files do not appear to encompass the nuclear reactors' core operational systems—which are supplied by Russia's state-owned Rosatom—they include purported technical blueprints detailing the ventilation and cooling infrastructure supporting Units 3 and 4, as well as what appear to be complete floor layouts of the facility's central control room. Additionally, the breach encompasses vendor proposals, lists of authorised suppliers, meeting records, equipment assessments, and insurance documentation. The materials span from 2016 through mid-2025, suggesting an extended period during which sensitive information may have been vulnerable. Security analysts stress that such comprehensive facility mapping could enable sophisticated actors to identify critical vulnerabilities, map support system dependencies, and pinpoint weak links throughout the supply chain.
The implications for nuclear security extend beyond the immediate facility itself. Nickolas Roth, a senior director at the Nuclear Threat Initiative, which advises governments on atomic energy safety protocols, characterised the breach as posing a "serious" risk to the plant's operational safety. The detailed infrastructure information now available to malicious actors could theoretically be used to target not just the facility's main systems but also its supporting infrastructure and the external organisations supplying critical components. This represents a particularly acute concern for a region where nuclear energy expansion is increasingly viewed as essential to meeting climate commitments and rising electricity demand across South and Southeast Asia.
Investigations into the incident are underway through multiple channels. India's Nuclear Power Corporation, which operates the country's atomic energy infrastructure, is communicating with Reliance regarding the breach, while the Indian Computer Emergency Response Team (CERT-In), the government's primary cybersecurity authority, is conducting its own technical investigation. Yotta reported detecting suspicious activity on its servers hosting Reliance's data on May 29, immediately terminating the activity and preventing what it assessed to be ransomware execution attempts. However, Reliance Infrastructure did not formally notify Yotta of external threat actors' breach claims until late June, creating a substantial gap in the response timeline. Despite these official investigations, neither India's Department of Atomic Energy nor Prime Minister Modi's office has publicly commented on the incident.
The breach underscores a troubling pattern within India's corporate and infrastructure sectors, where cybersecurity preparedness remains inconsistent despite the nation's growing technological sophistication. According to cybersecurity analysis by Surfshark, India ranks third globally in data breaches, with 28.9 million accounts compromised in the previous year, trailing only the United States and France. More alarmingly, a survey by the Data Security Council of India and cybersecurity firm Seqrite found that 73 percent of organisations surveyed across the country were uncertain whether they had ever experienced cyber attacks, while 57 percent acknowledged lacking fundamental cyber hygiene practices. These statistics reveal a fundamental gap between India's aspirations for technological leadership and the practical security infrastructure protecting its organisations and critical systems.
World Leaks follows a well-established operational pattern typical of contemporary ransomware gangs. The group demands substantial ransoms from targeted organisations, posting stolen data online when demands are ignored. In June, the same group demanded $1.5 million from Tata Group for files containing confidential component designs belonging to technology clients Apple and Tesla, subsequently publishing the materials when Tata declined payment. The group has not publicly disclosed its ransom demand in the Reliance case, though the posting of files suggests either an unmet demand or strategic decision to maximise exposure and potential extortion leverage.
This incident is not the first cyber threat faced by the Kudankulam facility itself. In 2019, malware attributed to North Korean hacking operations was discovered on the plant's administrative network, though the Nuclear Power Corporation maintained at that time that the affected systems were isolated and core plant operations remained uncompromised. That earlier incident raised fundamental questions about the plant's cyber defences that apparently remain inadequately addressed, particularly given the expanded scope of the current breach and its access to comprehensive facility documentation.
The political and strategic dimensions of this breach warrant careful consideration across Southeast Asia and the broader Indian Ocean region. Kudankulam represents a flagship project demonstrating India's commitment to nuclear energy expansion and serves as a model for regional partners evaluating their own atomic infrastructure investments. A security compromise of this magnitude—exposing detailed operational information to unknown actors—raises uncomfortable questions about India's capacity to safeguard critical infrastructure at a moment when the country is actively promoting nuclear energy as a cornerstone of regional energy security and climate resilience. The incident may prompt neighbouring countries and international partners to reassess their confidence in India's nuclear security protocols at a time when China is simultaneously advancing its own nuclear capabilities throughout Asia.
For Malaysia and other Southeast Asian nations monitoring India's nuclear development, this breach carries particular significance. As several regional economies explore nuclear energy options to diversify their power generation and meet climate commitments, the security vulnerabilities exposed at Kudankulam provide cautionary lessons about the cyber threats accompanying nuclear facility development. The incident demonstrates that advanced technological systems, regardless of their sophistication, remain vulnerable when supporting infrastructure and contractor networks lack adequate security frameworks. Regional policymakers evaluating nuclear energy investment should account not merely for the technical and financial requirements of such projects but also for the substantial cyber resilience infrastructure necessary to protect sensitive operational information from sophisticated threat actors operating with increasing sophistication across Asia.
The broader implications suggest that India's nuclear expansion ambitions, while strategically important for the subcontinent's energy future, face non-traditional security challenges requiring comprehensive institutional reform. The exposure of Kudankulam's sensitive infrastructure information to unknown parties operating through decentralised dark web platforms represents precisely the kind of complex, evolving threat that traditional security models struggle to address. Until Indian organisations, particularly those operating critical infrastructure, substantially upgrade their cybersecurity capabilities and adopt robust protective protocols, future breaches appear not merely possible but probable, with potentially serious consequences for facilities operating technologies as sensitive and strategically consequential as nuclear power generation.
