Kudankulam data leak: What hackers stole, how they got in and why nuclear reactors are safe

India’s largest nuclear power project, the Kudankulam Nuclear Power Project (KKNPP) in Tamil Nadu, has become the focus of a major cybersecurity investigation after a ransomware group allegedly leaked thousands of files linked to the facility on the dark web.

The leak has triggered concern among project officials, with local sources describing the situation as a cause of “commotion”. However, the state-run Nuclear Power Corporation of India Limited (NPCIL) has sought to reassure the public, stating that there has been no breach of nuclear safety systems or reactor operations.

NPCIL clarified that the leaked information relates only to conventional infrastructure associated with the project and does not involve critical nuclear control systems.

19,000 files and 14.3 GB of data leaked online

The data leak was reportedly carried out by a ransomware and extortion group called World Leaks, which published a large cache of stolen files on its dark web platform.

More from Explainers

Cybersecurity researchers said the group released a collection of around 19,000 files, totalling nearly 14.3 GB of data, with references linked to KKNPP.

The leaked documents reportedly cover a period between 2016 and mid-2025 and provide details about different aspects of the project’s construction and operations.

The files allegedly include:

The data has reportedly been available on the dark web since June, according to independent security researchers cited by Reuters.

How did the breach happen?

Investigators believe the attackers did not directly penetrate the highly protected systems that control the nuclear reactors. Instead, the breach appears to have occurred through a third-party contractor.

The leaked data was reportedly taken from the systems of Reliance Infrastructure, part of the Reliance Group, which was awarded a contract in 2018 to build key common infrastructure for Kudankulam’s Units 3 and 4.

Reliance Infrastructure acknowledged a partial data breach involving an enterprise server hosted by Yotta, an Indian cloud data centre provider.

According to Yotta’s technical assessment, its systems detected suspicious ransomware activity on May 29. While the immediate malware threat was contained, attackers had already extracted a large volume of project-related files before being stopped.

The hackers later allegedly used the stolen data as part of an extortion attempt.

NPCIL says nuclear safety systems were not affected

Amid concerns over a possible threat to India’s nuclear infrastructure, NPCIL issued a statement clarifying that the leaked documents were not connected to reactor safety systems.

The company said the information related only to Balance of Plant (BoP) common service facilities for Kudankulam Units 3 and 4, which are currently under construction.

“These facilities are of a conventional nature and are typically found in thermal power plants as well as other process industries. They are not related to nuclear safety or nuclear security systems,” NPCIL said.

Officials explained that such infrastructure includes facilities like external ventilation systems, water supply networks and other support services, whose designs are often shared with civilian contractors during large construction projects.

The core reactor systems, including the Russian-designed VVER-1000 pressurised water reactors, remain isolated from contractor networks, officials said.

Kudankulam has faced cyber threats before

The latest incident is not the first cybersecurity challenge faced by the Kudankulam facility.

In 2019, the plant reported a cyber intrusion involving Dtrack malware, which cybersecurity firms linked to North Korea’s state-sponsored Lazarus Group.

The malware was discovered on an administrative computer connected to the plant’s local network. Investigators said it was capable of collecting system information, keystrokes and network details.

At the time, NPCIL initially denied reports of a breach but later confirmed that an administrative system had been affected.

The company maintained that the reactor control systems were protected through separate, isolated networks that were not connected to the internet.

Third-party contractors emerge as cybersecurity challenge

The latest breach has renewed questions about cybersecurity risks beyond the reactor control room.

While India’s Department of Atomic Energy maintains strict safeguards around nuclear operations, large infrastructure projects often involve multiple private companies, contractors and cloud service providers.

Cybersecurity experts say these external links can become weak points if security standards are not equally strong across the entire supply chain.

The Indian Computer Emergency Response Team (CERT-In), along with nuclear security experts, is now investigating how attackers gained access to the contractor’s systems and managed to extract the data.

The probe will focus on identifying security gaps and strengthening safeguards around third-party networks connected to India’s strategic infrastructure.