Files Relating to India’s Largest Nuclear Power Plant Exposed in Data Breach

A data breach has exposed sensitive files related to India’s largest nuclear power plant, Kudankulam, highlighting the country’s vulnerability to cyber attacks on critical infrastructure. The incident occurred in May but was only publicly disclosed last week.

The breach involves a massive trove of files containing blueprints, supplier details, meeting records, and insurance policies for Units 3 and 4 of the plant, which are currently under construction with an expected completion date of 2027. Although the nuclear reactors’ core systems remain secure due to Russian suppliers Rosatom, the exposed data could potentially compromise the plant’s support systems, identify its vendors, and pinpoint vulnerabilities in its security chain.

India has a history of cyber attacks on critical infrastructure, including a 2019 incident in which malware linked to a North Korean hacker group was found on Kudankulam’s administrative network. This latest breach underscores the country’s vulnerability to such threats, which are increasingly common and often go unreported due to inadequate cybersecurity practices among Indian companies.

India ranks third globally in terms of data breaches, with 28.9 million accounts compromised last year alone. A staggering 73% of surveyed organizations across the country remain unaware of potential cyber attacks on their networks, while nearly 60% lack basic cybersecurity hygiene practices, leaving them exposed to even more severe breaches.

The Reliance Group, one of Kudankulam’s contractors, has downplayed the breach as a “partial data leak” attributed to an external threat actor. However, experts warn that such incidents can have serious consequences for national security and public safety.

“Sensitive information is being exposed on the dark web,” says Nickolas Roth, senior director at the Nuclear Threat Initiative. “This could be used by adversaries not just to map the plant’s support systems but also identify vulnerabilities in its security chain.”

The Kudankulam nuclear power plant is central to Indian Prime Minister Narendra Modi’s plans for atomic energy expansion. The government’s silence on the matter, coupled with Reliance Group’s reluctance to provide details about the breach, raises more questions than answers.

As India struggles to contain this cyber threat, it would be wise to revisit its approach to securing critical infrastructure and enforcing stricter cybersecurity standards across various industries. Given the growing sophistication of ransomware groups like World Leaks, which have targeted major Indian conglomerates in the past, it’s imperative that the country strengthens its defenses against such attacks.

The stakes are high: India’s nuclear security hinges on the ability of authorities to safeguard these sensitive installations from cyber threats. The recent breach at Kudankulam is a stark reminder that complacency will not suffice; instead, policymakers and industry leaders must join forces to combat this growing menace head-on.