A reported data breach involving files linked to the Kudankulam Nuclear Power Plant has put third-party infrastructure risk back at the centre of India’s critical-infrastructure cybersecurity agenda. The incident concerns data allegedly taken from a Reliance Group server hosted by Yotta, an Indian third-party data-centre provider. Reliance Group confirmed that some of its data had been compromised in a cyberattack and said the government had been informed. The company did not publicly identify the full scope of the breached material.
The allegedly exposed files were linked to Reliance Group’s work around Kudankulam, India’s largest nuclear power plant. One Reliance Infrastructure subsidiary had won a 2018 contract to design and build infrastructure for Kudankulam Units 3 and 4, which are under construction and expected to add a combined 2,000 MW of capacity. The leaked material reportedly included technical blueprints, supplier information, inspection records, equipment reviews, meeting documents and insurance-related files dated between 2016 and mid-2025. The authenticity of the documents has not been independently confirmed.
The ransomware group World Leaks is said to have posted 858,000 Reliance-linked files, with more than 19,000 described as sensitive. The group has previously claimed attacks on major global and Indian companies and typically publishes stolen data after ransom demands are not met. Nuclear Power Corporation of India Ltd. is reportedly in discussions with Reliance Group to assess the seriousness of the exposure, while CERT-In is examining the incident.
The episode is significant because it does not appear to centre on a direct compromise of nuclear plant operational systems. Instead, it highlights the exposure created by contractors, project partners, cloud and data-centre vendors, and long-lived engineering records. For critical infrastructure, such documents can still be sensitive even when they are not control-system credentials or live operational data. Engineering diagrams, inspection histories, supplier details and work packages can help adversaries understand dependencies, maintenance cycles and vendor relationships.
Kudankulam has previous cybersecurity history. In 2019, malware associated with a North Korean-linked group was detected on the plant’s administrative network, although authorities said operational systems were not affected. The new reported breach again underlines the security distinction between direct operational technology compromise and broader ecosystem compromise. For boards, CISOs and public-sector infrastructure leaders, the operational question is no longer limited to whether core systems are segmented, but whether sensitive project, design and contractor data is governed with equivalent discipline across the supply chain.
