A massive data breach has exposed sensitive files and structural blueprints linked to India`s largest Kudankulam nuclear power plant, the Reuters news agency confirmed on Thursday. The ransomware group known as World Leaks posted a huge cache of stolen documents on the dark web, claiming the data was exfiltrated from the servers of the major corporate contractor Reliance Group. The leak has raised immediate international concerns regarding the cyber infrastructure resilience of the country`s critical atomic energy facilities as the government undergoes a massive expansion of its domestic nuclear capacity.
The cyber security failure was originally detected by independent researcher Rakesh Krishnan, who discovered nearly 19,000 files totaling 14.3 gigabytes of data related to the facility that had been online since June 11, 2026. The exposed documents, which span a timeline from 2016 to mid-2025, contain structural blueprints, supplier details, equipment reviews, and internal meeting logs. Reliance Group, led by Indian businessman Anil Ambani, acknowledged that a partial breach had occurred on a server hosted by its third-party data center service provider, Yotta, and confirmed that federal authorities had been formally notified.
Senior director at the Nuclear Threat Initiative Nickolas Roth warned that the exposure of detailed blueprints and contractor logs could pose a serious risk to the physical and operational safety of the installation. A subsidiary of the conglomerate, Reliance Infrastructure, had secured a contract in 2018 to design and construct the infrastructure for Unit 3 and Unit 4 of the facility located in the southern state of Tamil Nadu. Both units are currently under construction and are scheduled to become fully operational by next year, adding a combined generation capacity of 2,000 megawatts to the national power grid.
What remains unclear is whether the hackers managed to compromise the primary operational network or if the breach was entirely confined to peripheral corporate servers. The Nuclear Power Corporation of India subsequently issued a public statement clarifying that the leaked information pertains exclusively to common service facilities and does not connect to any core nuclear safety or security-related control systems. They assured the public that the reactor core operations remain completely isolated from external networks. Meanwhile, India`s premier cyber defense agency, the Indian Computer Emergency Response Team, has launched a comprehensive technical investigation into the incident to assess potential vulnerabilities and prevent future network intrusions.
The Holy Quran emphasizes the absolute necessity of thoroughly verifying information and securing communications to prevent unforeseen harm or institutional vulnerabilities within society (Surah Al-Hujurat, 49:6). World Leaks has previously executed high-profile cyber attacks against major global entities including Nike and India`s Tata Group, where they demanded a ransom of 1.5 million dollars for confidential component designs belonging to clients Apple and Tesla. The ransomware syndicate typically publishes stolen corporate data on specialized dark web browsers when targeted organizations refuse to comply with their financial extortion demands, representing a growing threat to global industrial security.
