Cybersecurity of Critical Infrastructure in India

#GS-3 #Science & Technology #Cyber Security #Infrastructure #Critical Infrastructure #CERT-In #NCIIPC

Key takeaways

CERT-In recorded over 29.44 lakh cyber incidents in 2025, representing an 85% surge compared to 2023.
A major supply chain breach at data center Yotta exposed 19,000 files totaling 14.3 GB of sensitive data related to the Kudankulam Nuclear Power Plant.
The average cost of an enterprise data breach in India reached Rs 25.5 crore in 2026.
Key regulatory bodies include NCIIPC under Section 70A and CERT-In under Section 70B of the IT Act 2000.
The Digital Personal Data Protection (DPDP) Act 2023 creates security gaps because it excludes non-personal technical blueprints and schematics held by vendors.

A severe ransomware attack recently hit the third-party data center Yotta.
This breach exposed about 19,000 files totaling 14.3 GB of sensitive data.
The stolen files directly linked to the Kudankulam Nuclear Power Plant.
This incident highlighted major cybersecurity vulnerabilities in supply chains servicing India's strategic assets.

Protecting national strategic assets requires much more than basic physical perimeter security or network firewalls.
Relying solely on air-gapped systems no longer provides complete isolation from modern cyber threats.
Government agencies increasingly rely on private contractors and commercial cloud platforms to handle sensitive operations.
This expanding third-party ecosystem frequently exposes critical technical designs, operational blueprints, and sensitive contracts to cyber risks.

CERT-In recorded over 29.44 lakh cyber incidents in 2025, marking an 85% increase from 15.92 lakh in 2023.
Indian public service organizations and government bodies face more than 4,900 cyberattacks every week.
The average cost of a data breach in India climbed 16% to reach Rs 25.5 crore in 2026.
Complex IT environments and extended operational recovery times primarily drive up these data breach expenses.
The Kudankulam vendor breach leaked data spanning from 2016 to 2025, including engineering drawings and inspection reports.

Weak cryptographic keys in eight intermediate CA certificates caused an emergency browser revocation for eMudhra.
This technical cryptographic failure forced eMudhra to withdraw from the global SSL/TLS certificate registry.
A leak exposed 3,897 verified customer records of the State Bank of India (SBI) within a 3.75-lakh-record dataset on the dark web.
Law enforcement launched Operation Trident to dismantle a massive cyberfraud and hawala network across multiple states.
This operation froze 1,424 mule accounts tied to a Rs 100-crore nexus and investigated transactions worth Rs 28,000 crore.
The Yotta data breach compromised 14.3 GB of vendor files, proving that contractor networks remain a primary vulnerability.

The National Critical Information Infrastructure Protection Centre (NCIIPC) acts as the main agency under Section 70A of the IT Act 2000.
It protects critical information infrastructure whose impairment would harm national security, public health, or economic stability.
NCIIPC sets national security guidelines and performs regular vulnerability assessments across vital sectors like nuclear energy, power, and defense.
The Indian Computer Emergency Response Team (CERT-In) functions as the primary incident response agency under Section 70B of the IT Act 2000.
CERT-In issued the 2022 Cyber Security Directions, making six-hour breach reporting and system log retention legally mandatory.
Specialized Sectoral CSIRTs manage specific industry risks, with CSIRT-Power launched in 2024 and CSIRT-Fin operating since 2022.
The government established the Cyber Crisis Management Plan (CCMP) to keep public utilities functioning during cyber warfare or cyber-terrorism attacks.

Attackers avoid well-defended core networks and instead target vulnerable third-party contractors, suppliers, and commercial cloud hosts.
Hackers exploited hosting provider Yotta to obtain Kudankulam engineering plans stored by Reliance Infrastructure.
Advanced Persistent Threat groups deploy silent malware inside administrative networks to conduct long-term espionage without detection.
The Dtrack malware, linked to North Korea's Lazarus Group, was discovered inside Kudankulam's administrative network in 2019.
Ransomware syndicates extract proprietary files before encrypting local backups, threatening public releases unless victims pay cryptocurrency ransoms.
The Digital Personal Data Protection (DPDP) Act 2023 covers personal data but fails to protect shared non-personal engineering blueprints.
Commercial contracts currently serve as the only protection for shared technical files, leaving major legal gaps in non-personal data security.

India must establish a Security Follows the Data legal rule that applies mandatory security standards across the entire lifespan of sensitive data.
All private vendors, subcontractors, and cloud hosts processing sensitive files must meet mandatory NCIIPC security standards.
Organizations should adopt a strict Zero-Trust Architecture that verifies every user, device, and network connection continuously.
Agencies must enforce data minimization policies so contractors receive only essential technical files and delete them immediately after contract completion.
Authorities should replace basic self-compliance paperwork with aggressive, independent Red-Team penetration tests across vendor networks.
India needs a unified national security framework connecting CERT-In, NCIIPC, and sectoral regulators to handle supply chain threats together.

The Kudankulam incident proves that critical national infrastructure includes all connected external suppliers and cloud hosts, not just physical facilities.
Relying only on internal firewalls leaves strategic systems exposed if third-party contractors maintain weak cybersecurity practices.
Building long-term cyber resilience requires moving toward data-centric protection and enforcing strict zero-trust practices across all contractor networks.