Hackers Breach India's Largest Nuclear Plant, Steal Sensitive Data
India’s largest nuclear power plant has been targeted in a massive cyberattack, resulting in the theft and online leak of thousands of sensitive documents. The ransomware group World Leaks claimed responsibility for breaching the Kudankulam Nuclear Power Plant (KNPP) in Tamil Nadu, uploading a cache of data to the dark web. The stolen files reportedly include blueprints of facility sections and detailed information about component suppliers.
In response, the Nuclear Power Corporation of India (NPCIL), the plant’s owner and operator, confirmed the security incident but sought to downplay the risks. An official statement asserted that the compromised data did not relate to nuclear safety or reactor security systems, describing the affected facility as a conventional part of the plant similar to those found in standard thermal power stations.
The breach was traced back to a third-party vendor. The stolen information was reportedly taken from systems belonging to the Reliance Group, which has held a contract for support work at the plant since 2018. Reliance confirmed a partial breach of its data on a server hosted by Indian data centre provider Yotta, adding that the incident had been reported to national cybersecurity authorities. Yotta claimed it had detected and flagged suspicious ransomware activity as early as 29 May.
Despite official reassurances, international security experts have expressed alarm. Nickolas Roth, a senior director at the Nuclear Threat Initiative, warned that such a data leak could pose serious safety risks to the plant. The hacker group World Leaks is known for aggressively publishing stolen corporate data if ransom demands are not met; it previously leaked confidential designs from Tata Group clients Apple and Tesla after a $1.5 million ransom was ignored.
The Kudankulam facility, built in collaboration with Russian state nuclear company Rosatom, currently operates two 1,000 MW reactors, with plans to expand to six units. This is not the plant’s first cybersecurity incident; in 2019, malware linked to North Korean hackers was discovered on its administrative network.