A significant cybersecurity incident has emerged involving India's largest nuclear facility, the Kudankulam Nuclear Power Plant in Tamil Nadu, after a ransomware gang known as World Leaks posted a substantial cache of sensitive files on the dark web. The exposed material, allegedly sourced from Reliance Group—a major contractor at the facility—includes purported architectural blueprints, supplier directories, and operational records spanning nearly a decade. The disclosure underscores mounting vulnerability in India's critical infrastructure and raises alarm bells for neighbouring Southeast Asian nations grappling with similar threats to their own sensitive installations.
The Kudankulam facility represents the cornerstone of India's nuclear expansion strategy under Prime Minister Narendra Modi, who has prioritised atomic energy as a cornerstone of the country's long-term energy security and climate goals. As India's largest operational nuclear power station, the plant symbolises New Delhi's commitment to diversifying its energy portfolio away from fossil fuels. Units 3 and 4, currently under construction by Reliance Infrastructure and scheduled for completion by 2027, will collectively generate 2,000 megawatts of electricity once operational—enough to power several million households. This expansion represents a substantial investment in the nation's energy infrastructure at a time when electricity demand continues climbing across South Asia.
Reliance Group, led by billionaire Anil Ambani, confirmed the security incident in a statement to Reuters, characterising it as a "partial breach" of data housed on servers operated by Yotta, a Delhi-based data centre provider. While the conglomerate acknowledged that government authorities have been briefed, it declined to elaborate on the extent or nature of compromised information. This opacity reflects the delicate sensitivities surrounding nuclear facility security and the political implications of acknowledging vulnerability. The vagueness of Reliance's disclosure left significant questions unanswered about the scale of the intrusion and what remedial measures have been implemented to prevent recurrence.
World Leaks, the cybercriminal group responsible for the breach, has previously targeted high-profile multinational corporations including Nike and India's Tata Group, establishing a track record of stealing proprietary data and demanding ransom payments before publishing stolen materials online. The group's modus operandi involves placing confidential files on accessible dark web platforms only after companies refuse extortion demands. In a comparable incident last year, the group claimed to have extracted confidential component specifications belonging to Tesla and Apple from Tata Group servers and demanded $1.5 million, subsequently releasing the data when the company declined to negotiate. This pattern suggests calculated criminal enterprise rather than ideological hacking.
The breach reportedly involves approximately 19,000 files deemed particularly sensitive, extracted from a larger tranche of 858,000 Reliance documents. While Reuters examined samples of the disclosed materials and found them dated between 2016 and mid-2025, independent verification of their authenticity remained impossible. The collection encompasses meeting minutes, inspection protocols, equipment specifications, insurance documentation, and vendor information. Critically, documents appear to include architectural layouts of shared control systems and detailed blueprints for ventilation and cooling infrastructure serving Units 3 and 4—systems essential to safe reactor operation and emergency response.
Security analysts at the Nuclear Threat Initiative, a respected Washington-based think tank advising governments on atomic security, characterised the exposure as presenting "serious" risks to facility safety. The concern reflects a broader understanding that sophisticated adversaries could weaponise leaked infrastructure details to identify vulnerabilities, map supply chain dependencies, and exploit gaps in security architecture. According to Nuclear Threat Initiative director Nickolas Roth, leaked documentation effectively hands malicious actors a roadmap showing "not just who has access to the project but which systems that access reaches," potentially enabling coordinated sabotage or espionage targeting multiple operational layers simultaneously.
Investigation records indicate that Yotta detected suspicious activity on its servers hosting Reliance data on May 29, and claims it immediately terminated the intrusion while preventing ransomware installation. However, Reliance Infrastructure did not formally notify the data centre operator of a potential breach until late June, following announcements by the threat actors themselves. This delay between detection and disclosure raises questions about internal communication protocols and crisis management procedures. Yotta stated it remains unable to independently verify the cybercriminals' claims, though it has shared technical analysis with Reliance and continues cooperating with ongoing official investigations.
The Nuclear Power Corporation of India, the state entity responsible for commissioning and operating all commercial reactors nationally, has maintained contact with Reliance regarding the incident, while India's primary cybersecurity response body, the Indian Computer Emergency Response Team (CERT-In), has initiated formal investigation. Neither organisation provided substantive comment, and Prime Minister Modi's office did not respond to queries, suggesting a strategy of information restriction around national security matters. The muted official response contrasts sharply with the transparency increasingly demanded by international nuclear regulators and reflects India's historically guarded approach to acknowledging vulnerabilities in strategic infrastructure.
The exposed materials do not appear to encompass reactor core systems—those critical components supplied exclusively by Russia's Rosatom—but instead focus on ancillary systems including cooling mechanisms and control room infrastructure. This distinction matters considerably for immediate safety implications, as reactor core integrity depends on sophisticated Russian-supplied systems unlikely to have been compromised. Nevertheless, auxiliary systems remain integral to safe operations; failures in cooling systems or control mechanisms can precipitate serious incidents if adversaries exploit known vulnerabilities or design weaknesses revealed through leaked blueprints.
One particularly revealing document disclosed a joint insurance arrangement between Reliance Infrastructure and the Nuclear Power Corporation covering potential terrorism-related damage to Units 3 and 4, with a stated value of $112 million. This disclosure itself constitutes potentially valuable intelligence, suggesting the facility operators recognised elevated risk profiles warranting elevated coverage—precisely the kind of threat assessment information adversaries seek. Insurance documentation often reflects institutional threat models and risk assumptions, making such disclosures operationally valuable to actors contemplating disruption.
The incident represents India's second documented cyber vulnerability involving the Kudankulam facility. In 2019, malware attributed to North Korean hacking operatives penetrated the plant's administrative networks, prompting immediate investigation by the Nuclear Power Corporation. While authorities insisted at that time that reactor systems remained unaffected, the recurrence of incidents indicates persistent difficulty isolating sensitive operations from external threats. This pattern mirrors broader challenges facing critical infrastructure across South Asia, where rapid digitalisation has outpaced maturation of defensive cybersecurity protocols.
India confronts a broader crisis in cyber preparedness that extends far beyond this single incident. The country ranks third globally in frequency of data breaches, with 28.9 million accounts compromised in the preceding year according to cybersecurity firm Surfshark, trailing only the United States and France. A comprehensive survey conducted by India's Data Security Council and cybersecurity firm Seqrite among 204 organisations revealed that 73 percent remained uncertain whether they had ever experienced cyberattacks, while 57 percent acknowledged lacking fundamental cyber hygiene practices. These figures suggest systemic institutional weakness rather than isolated technical failures.
For Malaysia and other Southeast Asian nations, the Kudankulam breach carries instructive lessons about vulnerability in critical infrastructure sectors and the inadequacy of defensive postures that lag behind evolving threat sophistication. As countries across the region accelerate development of nuclear, renewable, and digital infrastructure, this incident exemplifies how state-sponsored vendors, private contractors, and third-party service providers can collectively create security exposures that no single entity controls completely. Regional governments increasingly recognise that critical infrastructure protection requires coordinated approaches transcending individual national responses, suggesting opportunities for enhanced multilateral cybersecurity cooperation frameworks across ASEAN and Indo-Pacific contexts.
