KUDANKULAM NUCLEAR POWER PROJECT DATA BREACH — CYBERSECURITY CHALLENGES TO CRITICAL INFRASTRUCTURE

KUDANKULAM NUCLEAR POWER PROJECT DATA BREACH — CYBERSECURITY CHALLENGES TO CRITICAL INFRASTRUCTURE

1. Why Kudankulam is Important

• Kudankulam Nuclear Power Plant (KKNPP) is located in Tirunelveli district of Tamil Nadu and is India’s largest nuclear-power site by planned generating capacity.
• Units 1 and 2 are already operational, each with a capacity of 1,000 MW, while Units 3–6 are under construction.
• Once all six units are operational, the site is designed for 6,000 MW capacity.

2. India–Russia Cooperation

• Kudankulam is being implemented by Nuclear Power Corporation of India Limited (NPCIL) with technical cooperation from the Russian Federation.
• The reactors are VVER-type pressurised/light-water reactors of Russian design.
• Units 3 and 4 are being developed under the India–Russia Inter-Governmental Agreement.

3. Nature of the 2026 Incident

• In 2026, ransomware group World Leaks claimed to have published files connected with Kudankulam on the dark web.
• Reuters reported that around 19,000 apparently sensitive files, forming part of a much larger data cache, were exposed.
• The uploaded material similarly describes the incident as a third-party data breach involving project-related records.

4. What Kind of Data Was Reportedly Exposed

• The leaked cache reportedly included engineering drawings, supplier lists, meeting and inspection records, insurance documents and infrastructure details.
• Some material allegedly related to cooling, ventilation and other common infrastructure of Units 3 and 4.
• The uploaded material also refers to layouts, equipment details and supplier information.

5. Important Official Clarification

• NPCIL stated that the compromised material did not relate to nuclear safety or security systems.
• It said the files concerned conventional Balance of Plant (BoP) common-service facilities rather than reactor-core or nuclear-safety systems.
• Therefore, it would be inaccurate to describe the event as a confirmed compromise of the nuclear reactor-control system.

6. Third-Party and Supply-Chain Risk