Beyond Kudankulam’s fence, a cybersecurity challenge

The data breach involving files related to the Kudankulam nuclear power project in Tamil Nadu, reported on July 15, 2026, indicates that India’s cybersecurity policy for critical infrastructure is behind the perimeter that now extends well beyond the actual sensitive facility.The most consequential breach may never touch the facility at all. It could occur in a rented server in a commercial data centre or even within a contractor’s network which has documents that the contractor is entitled to possess. That, in essence, is what appears to have happened in the case of Kudankulam. And that is why the incident deserves more attention than the reassurances that followed would suggest.The perimeter beyond the plantIn mid-July, the group World Leaks began posting sections of an alleged leak of nearly 19,000 files totalling 14.3 GB relating to Kudankulam on its dark web portal. As reported by Reuters, the material spans the years 2016 to about 2025. It includes engineering drawings, supplier information, inspection records, meeting minutes, and insurance documents. The breach was confirmed by Reliance Infrastructure — it won the engineering, procurement, and construction contract for Kudankulam Units 3 and 4 — and added that the data had been stored on a server by its third-party data centre Yotta. It also said that the government had been notified. Yotta confirmed ransomware activity on its site on May 29, and said that the activity has been contained. By June the attackers were claiming the data and demanding a ransom. The Nuclear Power Corporation of India Limited (NPCIL) said that the information was only on documents relating to non-nuclear infrastructure, and unrelated to systems supporting nuclear safety.In all this, caveats are necessary. A ransomware group’s claims are not evidence as such groups routinely inflate what they hold. Nothing in the public domain indicates that the reactors or control and safety systems, isolated from the Internet by design, were accessed. The NPCIL’s clarification should be taken seriously.The pertinent question is not whether the “reactor was hacked” — it was not — but how much operationally relevant information about India’s most sensitive facilities exists beyond the facilities themselves. These include what is held by contractors, subcontractors, service providers, and their employees, a few of whom fall within the reach of India’s regulatory framework.This is not the first time that Kudankulam has featured in such a discussion. In 2019, the Dtrack malware, which cybersecurity researchers associate with North Korea’s Lazarus Group, was found on a computer connected to the plant’s Internet-facing administrative network. The NPCIL initially dismissed the reports but confirmed the infection, while emphasising that the critical internal network had been isolated and unaffected. The two are not technically connected, but there is a link. In both instances, the core held and the exposure was at the periphery. First, it was an administrative network; now, it was a contractor’s server in a commercial data centre. Seven years later, the question is whether the lesson of 2019 was ever taken seriously — that security risks extend beyond critical facilities and whether there has been a systematic approach to securing the ecosystem around critical infrastructure. The latest incident suggests that it was not.A cyber blind spotThese ecosystems are large and growing. A modern nuclear plant, electricity grid, defence production facility or telecommunications system cannot be built or operated as a single organisation. Public utilities sit alongside private engineering and construction firms, equipment and software suppliers, cloud and data centre providers, insurers, certification agencies and layers of subcontractors, many of whom are foreign technology partners. Each of them may legitimately hold sensitive data, such as drawings, purchase order forms, reports, personal data, credentials and schedules. But this information is not necessarily protected by the security measures in place at the main facility, such as network segmentation, air-gapped control systems and physical security. This creates a cybersecurity risk across the supply chain. In other words, an organisation’s security depends not only on its own safeguards but also on those of every other entity that has access to its data.A sophisticated attacker can use this information to identify contractors, find potential targets for phishing attacks and determine which subcontractor offers the easiest route into the system. As Nickolas Roth of the Nuclear Threat Initiative has noted, such documents may also reveal how systems can be accessed. The larger concern is that strategic information can pose a security risk even if it does not provide direct access to operational systems. Any serious assessment must therefore examine not just what information was taken but also how it could be misused in the future.India faces a gap in cybersecurity governance. It is not that institutions or rules are absent. The Indian Computer Emergency Response Team, CERT-In, is the national agency responsible for responding to cybersecurity incidents, and its 2022 directions made prompt reporting of such incidents mandatory. The National Critical Information Infrastructure Protection Centre (NCIIPC), established under Section 70A of the Information Technology Act, is responsible for protecting critical information infrastructure.However, India’s cybersecurity rules do not necessarily ensure uniform protection for sensitive information shared across contractors, subcontractors and data centres. Although existing regulations cover several categories of service providers, questions remain about the adequacy of security standards, oversight and accountability across the supply chain. In law, a “protected system” belongs to an infrastructure, and the obligations fall on its operator. Once project information is shared with a contractor, and then with a subcontractor or a data centre, its protection depends largely on contractual arrangements. The Digital Personal Data Protection Act does not generally cover engineering drawings and other technical information that do not contain personal data.This creates a problem of accountability. The operator can truthfully say that its systems were not breached, the contractor can blame its hosting provider, and the host to the malware it had. All these claims may be true, yet sensitive documents may still end up on the dark web. The key question raised by the Kudankulam incident is who is responsible for protecting critical infrastructure information once it leaves the operator’s control.Expansion and risksIndia is expanding the Kudankulam plant to a capacity of 6,000 MW, developing smart grids and digital public infrastructure, opening up the defence and space sectors to private companies under Atmanirbhar Bharat, and moving government data and services to commercial cloud platforms. Each of these steps makes strategic sense. But they also mean that more private companies will have access to sensitive information, increasing the risk of cyberattacks and creating more ways for attackers to gain access. A cybersecurity policy designed for a system in which the government builds and controls everything is no longer adequate for one that depends on private contractors, subcontractors and commercial infrastructure.What are the steps to be taken? First, security obligations must follow the data, not the organisation. Any contractor, subcontractor, or cloud provider handling critical infrastructure data must be bound to defined standards, with liability and audit requirements in the procurement contract. Second, India needs real data classification so that a contractor constructing a conventional facility holds only the data that is needed and only for as long as it is needed. Third, annual compliance certificates should give way to third-party risk assessment, including red-team exercises that test the vendor ecosystem and not merely an operator’s perimeter. Fourth, there should be zero-trust. The assumption should be that no network is safe. Every access point should be verified. This should be the policy for projects of national importance. Finally, CERT-In, the NCIIPC, sectoral regulators, and operators should converge on a single national framework for critical-infrastructure supply-chain security — one that assigns responsibility before a breach rather than after. Whether that comes through new legislation or a creative reading of the IT Act can wait.In the digital era, critical infrastructure is not a building surrounded behind a fence; it is a layered system with many access points, many of them are outside the operator’s control. India would be best served by ensuring that every organisation holding the reactor’s secrets held to the same standard as those secrets deserve.Khyati Singh is Research Analyst, Centre for North America and Strategic Technologies, MP-IDSA and the author of ‘Cyber Leviathan: Digital Strategies in International Relations’