Beyond Kudankulam’s Fence: Cybersecurity Challenges in Critical Infrastructure

27 Oct 2026

Tags: Internal Security   Cyber & Media   Digital threats

Source: The Hindu

Kudankulam Data Breach: Key Facts

• Incident (July 2026): The ransomware group World Leaks began publishing an alleged leak of nearly 19,000 files (14.3 GB) related to the Kudankulam Nuclear Power Project, Tamil Nadu, covering approximately 2016–2025.
• Nature of data: The leaked material reportedly included engineering drawings, supplier details, inspection records, meeting minutes and insurance documents.
• Source of breach: Reliance Infrastructure, the Engineering, Procurement and Construction (EPC) contractor for Kudankulam Units 3 and 4, confirmed that the data was stored on a third-party data centre server operated by Yotta. Yotta reported ransomware activity on May 29, 2026, which it said had been contained. By June, attackers were claiming possession of the data and demanding a ransom.
• NPCIL’s clarification: The Nuclear Power Corporation of India Limited (NPCIL) stated that the documents concerned non-nuclear infrastructure and were unrelated to systems supporting nuclear safety. There is no publicly available evidence that the reactors or their control and safety systems were compromised.
• Caveat: Ransomware groups may exaggerate their claims; therefore, the attackers’ assertions must be distinguished from independently verified facts.

The Cybersecurity Perimeter Beyond the Plant

• Core concern: Even if a critical facility remains secure, sensitive information held by its contractors, subcontractors, employees and third-party service providers may be exposed.
• 2019 Kudankulam incident: The Dtrack malware, associated by cybersecurity researchers with North Korea’s Lazarus Group, was detected on a computer connected to the plant’s Internet-facing administrative network. NPCIL subsequently confirmed the infection but maintained that the isolated critical internal network was unaffected.
• Common lesson: The 2019 malware incident and the 2026 data breach are not technically connected, but both highlight vulnerabilities at the periphery of critical infrastructure, beyond its core operational systems.
• Strategic implication: Cybersecurity assessments must examine not only direct access to operational systems but also the quantity, sensitivity and potential misuse of information available outside the facility.

Supply-Chain Cybersecurity: A Major Blind Spot

• Growing ecosystem: Nuclear plants, electricity grids, defence facilities and telecommunications networks depend on public utilities, private engineering firms, equipment and software suppliers, cloud platforms, data centres, insurers, certification agencies and multiple layers of subcontractors.
• Sensitive information exposure: These entities may legitimately possess technical drawings, purchase orders, inspection reports, employee data, credentials and operational schedules, without being subject to the same safeguards as the core facility.
• Attack pathways: Stolen documents can help attackers identify contractors, design targeted phishing campaigns, discover weak subcontractors and understand potential routes into systems.
• Indirect security threat: Even without direct access to operational technology, leaked documents can reveal system architecture, access procedures and other information that may facilitate future attacks.
• Key principle: The security of critical infrastructure depends not only on the safeguards of its operator but also on the cybersecurity practices of every entity handling its information.

Gaps in India’s Cybersecurity Governance

• CERT-In: The Indian Computer Emergency Response Team is India’s national agency for responding to cybersecurity incidents. Its 2022 directions mandate reporting of specified cyber incidents within six hours of noticing them or being informed of them.
• NCIIPC: The National Critical Information Infrastructure Protection Centre, established under Section 70A of the Information Technology Act, 2000, is responsible for protecting critical information infrastructure.
• Regulatory gap: Existing rules and institutions do not necessarily ensure uniform security standards, monitoring and accountability across the entire supply chain of contractors, subcontractors and data centres.
• Limited legal coverage: Under the IT Act, obligations concerning a formally designated protected system primarily attach to the relevant infrastructure and its authorised operator. Once technical information is shared with external entities, its protection may depend heavily on contractual arrangements.
• DPDP Act, 2023: The Digital Personal Data Protection Act primarily concerns digital personal data; it does not generally protect technical documents such as engineering drawings that contain no personal data.
• Accountability deficit: The operator, contractor and hosting provider may each disclaim responsibility because the breach occurred outside their own systems, leaving gaps in accountability despite the exposure of sensitive information.

Expansion of Digital Infrastructure and Emerging Risks

• Nuclear energy: Kudankulam’s expansion towards 6,000 MW increases the importance of securing information shared across its project ecosystem.
• Digital transformation: Smart grids, digital public infrastructure and the migration of government services and data to commercial cloud platforms expand dependence on private technology providers.
• Strategic sectors: Greater private-sector participation in defence and space under Atmanirbhar Bharat creates additional external access points for sensitive information.
• Policy challenge: Cybersecurity frameworks designed around government-owned and centrally controlled systems must adapt to infrastructure increasingly dependent on private contractors and commercial digital services.

Measures to Strengthen Critical-Infrastructure Cybersecurity

• Data-centric security obligations: Security requirements, liability provisions and audit obligations should follow sensitive data across contractors, subcontractors and cloud providers through enforceable procurement contracts.
• Data classification and minimisation: Contractors should receive only the information necessary for their work, for the minimum required duration, reducing unnecessary exposure.
• Independent risk assessments: Routine compliance certificates should be supplemented with third-party assessments and red-team exercises that test vulnerabilities across the entire vendor ecosystem.
• Zero-trust architecture: No user, device or network should be trusted automatically; every access request must be verified, with access restricted according to necessity.
• Unified national framework: CERT-In, NCIIPC, sectoral regulators and infrastructure operators should develop a common framework assigning clear responsibilities for supply-chain cybersecurity before a breach occurs.
• Legal and regulatory reform: India should clarify accountability for protecting critical infrastructure information outside an operator’s direct control, through new legislation or appropriate interpretation of the existing IT Act.

Important Concepts for UPSC

• Critical Information Infrastructure (CII): Computer resources whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety. Section 70A of the IT Act provides for the protection of CII through NCIIPC.
• Air-gapped systems: Systems physically isolated from external networks, particularly the Internet, to reduce exposure to remote cyberattacks. Isolation lowers risk but does not eliminate threats arising through removable media, insiders or connected peripheral systems.
• Zero-trust security: A cybersecurity model based on continuous verification of users, devices and access requests rather than assuming that systems or users within a network are trustworthy.
• Supply-chain attack: A cyberattack that exploits a third-party supplier, contractor or service provider to compromise information, systems or organisations further along the supply chain.

Conclusion: The Kudankulam incident highlights that critical infrastructure security extends beyond physical boundaries and operational networks. India must move from a facility-centric approach to a data-centric, zero-trust and supply-chain-wide cybersecurity framework, ensuring that every entity handling strategically sensitive information meets appropriate security standards.