India's Largest Nuclear Project Breached, Thousands of Secret Documents Leaked

A data breach is suspected to have hit the Kudankulam Nuclear Power Plant, India’s largest nuclear facility. The ransomware group World Leaks uploaded nearly 19,000 files to the dark web, claimed to originate from Reliance Group, one of the project’s contractors.

The leaked documents are said to include blueprints of several facilities, supplier data, inspection records and various other technical documents related to the Kudankulam nuclear power plant project. The breach has raised concerns over the security of one of India’s most strategic energy infrastructures.

Reliance Group confirmed that a “partial breach” had occurred involving data stored on servers belonging to its third-party data centre provider, Yotta.

“There was a partial breach of our data held on servers hosted by Yotta, and the government has been informed of this incident,” Reliance said in a statement, as quoted by Reuters on Thursday (16 July 2026).

However, the company did not specify what type of data the perpetrators managed to access.

The incident has sparked concerns regarding the security of India’s strategic facilities. Nickolas Roth, Senior Director of the Nuclear Threat Initiative, said the leak could pose serious risks to the plant’s safety.

“Those files could show hostile parties not only who has access to the project, but also which systems can be reached through that access,” he said.

Independent cyber security researcher Rakesh Krishnan revealed that around 19,000 files totalling 14.3 gigabytes (GB) have been available online since 11 June.

Reuters reviewed the documents, dated from 2016 to mid-2025, but has not been able to verify their authenticity. The documents are believed to include blueprints of ventilation and cooling systems, supplier lists, meeting minutes, inspection results, equipment evaluations and even the project’s insurance policies.

Kudankulam is the largest nuclear plant among the seven operating in India and is a flagship project in Prime Minister Narendra Modi’s ambition to expand national nuclear energy capacity. Reliance Infrastructure itself won a contract in 2018 to build infrastructure for Units 3 and 4, which are targeted to begin operations in 2027 with a combined capacity of 2,000 megawatts.

A source familiar with the investigation said the Nuclear Power Corporation of India has been coordinating with Reliance regarding the incident, while India’s national cyber security agency, CERT-In, is conducting an investigation. To date, the Nuclear Power Corporation, CERT-In, India’s Department of Atomic Energy and Prime Minister Modi’s office have not issued official responses.

Yotta said it detected suspicious activity on 29 May on a Reliance Infrastructure server it manages. “The activity was immediately halted and a suspected ransomware execution was prevented,” the company said.

However, at the end of June, Reliance informed Yotta of a data leak claim made by an “external threat actor”. Yotta stated it has not yet been able to verify the claim, but has handed over the results of its technical investigation to Reliance.

The leaked documents are said not to relate to the reactor’s core systems supplied by the Russian nuclear company Rosatom. Nevertheless, the files are believed to contain the layout of shared control rooms, support system designs, vendor proposals, approved supplier lists, and joint inspection records along with photographs of equipment.

One document also shows an insurance policy worth US112million, oraroundRp2.02trillion(atanexchangerateofRp18, 000/US), held by Reliance Infrastructure and the Nuclear Power Corporation to protect Units 3 and 4 in the event of a terrorist attack. Researchers warned that such information could be exploited to map the plant’s support systems, identify supply chains and find security vulnerabilities.

The case adds to a list of cyber incidents affecting India’s strategic sectors. According to cyber security firm Surfshark, India was the third-worst affected country in the world for data breaches last year, with around 28.9 million accounts hacked.

Previously, the administrative network of the Kudankulam plant was also infiltrated by malware linked to a North Korean hacking group in 2019, although the operator at the time confirmed the plant’s main systems were unaffected.