Ransomware Group Leaks Kudankulam Nuclear Plant Files

A ransomware group known as World Leaks has published a large cache of files allegedly linked to India's Kudankulam Nuclear Power Plant on the dark web. The leak has raised fresh concerns over cybersecurity at the country's largest nuclear facility.

The leaked files, which number around 19,000, are purportedly sourced from Anil Ambani-led Reliance Group, one of the contractors involved in the Tamil Nadu-based nuclear project. The files are dated between 2016 and mid-2025 and include blueprints of ventilation and cooling systems, supplier information, meeting records, equipment inspection reports, and insurance documents related to Units 3 and 4, which are currently under construction.

Reliance Group has confirmed that it experienced a partial breach involving data stored on a server hosted by third-party data centre provider Yotta. The conglomerate informed the government but did not specify what information had been compromised. Yotta detected suspicious activity on a Reliance Infrastructure server in May and terminated the activity immediately, preventing the suspected ransomware execution.

However, Yotta later learned of claims by external threat actors alleging a data breach. The company said it has been unable to verify those claims and is assisting with the ongoing investigation. The Nuclear Power Corporation of India is coordinating with Reliance, while the Indian Computer Emergency Response Team (CERT-In) is examining the incident.

Cybersecurity experts have warned that, if authentic, the leaked documents could help adversaries identify suppliers, map support systems, and potentially expose vulnerabilities in the plant's security infrastructure. However, the documents do not appear to include information related to the nuclear reactors' core systems supplied by Russia's Rosatom.

The Kudankulam Nuclear Power Plant is India's largest nuclear facility, with a capacity of 2000 MW. The plant is operated by the Nuclear Power Corporation of India and is located in the Tirunelveli district of Tamil Nadu. The plant has been in operation since 2013 and has been a significant source of electricity for the region.

The leak has raised concerns about the cybersecurity of India's critical infrastructure. The country has been investing heavily in cybersecurity measures, but the leak highlights the need for more robust security protocols. The government has been working to strengthen cybersecurity laws and regulations, but more needs to be done to protect critical infrastructure from cyber threats.

The investigation into the leak is ongoing, and it is unclear what the motivations of the ransomware group are. However, the leak has highlighted the need for increased vigilance and cooperation between government agencies, contractors, and cybersecurity experts to protect India's critical infrastructure from cyber threats.

In conclusion, the leak of files linked to the Kudankulam Nuclear Power Plant has raised significant concerns about cybersecurity in India. The government and contractors must work together to strengthen security protocols and protect critical infrastructure from cyber threats. The incident highlights the need for increased investment in cybersecurity measures and more robust laws and regulations to protect India's critical infrastructure.

The leak has also raised questions about the role of third-party contractors in critical infrastructure projects. The fact that the leak occurred through a third-party server hosted by Yotta highlights the need for more robust security protocols for contractors working on critical infrastructure projects. The government must ensure that contractors are held to the same security standards as government agencies to prevent such leaks in the future.

Overall, the leak of files linked to the Kudankulam Nuclear Power Plant is a significant concern for India's cybersecurity. The government and contractors must work together to strengthen security protocols and protect critical infrastructure from cyber threats. The incident highlights the need for increased investment in cybersecurity measures and more robust laws and regulations to protect India's critical infrastructure.