A massive cache of files linked to India’s largest nuclear power facility, the Kudankulam Nuclear Power Plant, has been leaked on the dark web by ransomware group World Leaks. The compromised data includes purported facility blueprints and supplier information, which the hackers claimed were obtained from contractor Reliance Group.
Located in the southern state of Tamil Nadu, the Kudankulam plant is the central pillar of Indian Prime Minister (PM) Narendra Modi’s plans to expand the country’s atomic energy capacity.
The contractor, Reliance Group, led by Indian businessman Anil Ambani, confirmed that a “partial breach” of its data occurred on a server hosted by Yotta, a third-party Indian data center service provider.
Reliance stated that the government has been informed of the incident but did not disclose the specific nature of the compromised data.
Security experts warn that the exposure of THE documents could create significant safety vulnerabilities. Nickolas Roth, a senior director at the Nuclear Threat Initiative, stated that the data breach could pose a “serious” risk to the safety of the plant. He added that the files could “show an adversary not just who has access to the project but which systems that access reaches.”
The leaked material consists of roughly 19,000 files, totaling 14.3 gigabytes, marked under the plant’s acronym “KKNP.” Cybersecurity researcher Rakesh Krishnan noted that THE documents have been online since June 11.
The files represent the most sensitive portion of a larger 858,000-file leak from Reliance hosted on the World Leaks website.
The documents are dated from 2016 to mid-2025. While they do not appear to involve the core reactor systems supplied by Russia’s state-owned Rosatom, they contain technical details of the plant’s auxiliary systems.
Among the leaked files are purported blueprints for ventilation and cooling systems inside Unit 3 and Unit 4, alongside the complete floor layout of a common control room.
The cache also includes vendor proposals, a list of approved suppliers, records of a 2024 joint inspection by Reliance and the Nuclear Power Corporation of India, and equipment photos.
Reliance Infrastructure secured a contract in 2018 to construct infrastructure for Units 3 and 4. Both units are currently under construction and are scheduled to become operational by 2027, bringing a combined capacity of 2,000 megawatts.
Regarding the timeline of the breach, Yotta reported detecting suspicious activity on May 29 on the server hosting Reliance Infrastructure’s data. According to the service provider, the activity was immediately blocked, preventing the execution of the ransomware.
However, Reliance Infrastructure later notified Yotta at the end of June that external threat actors were claiming to have breached the data. Yotta stated that it could not independently verify the hackers’ claims but has shared its technical investigation with Reliance.
The Nuclear Power Corporation of India is in communication with Reliance regarding the leak. The country’s primary cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), is investigating the incident.
Nuclear Power Corporation Chairman Rajesh Veeraraghavan, CERT-In, the Indian government’s main press office, and the Department of Atomic Energy have not responded to requests for comment.
The ransomware group behind the leak, World Leaks, typically publishes corporate data when targeted entities refuse to pay ransom demands.
THE incident is the second cybersecurity event linked to the Kudankulam facility. In 2019, malware associated with a North Korean hacker group was detected on the plant’s administrative network. At the time, the Nuclear Power Corporation stated that the breach did not affect key plant systems.
According to cybersecurity company Surfshark, India ranked third globally for data breaches last year, with 28.9 million compromised accounts, trailing only the United States and France.
