Kudankulam Nuclear Plant Data Leak and India's Cyber Security Challenges

#GS-3 #Science & Technology #Cyber Security #Energy #Infrastructure #National #Current Events

Why in News

A ransomware group posted 14.3 GB of sensitive data containing 18,997 internal documents from the Kudankulam Nuclear Power Plant (KKNPP) onto the dark web.

This security breach involved the illegal copying and online disclosure of non-classified building plans and management files for Units 3 and 4 of India's largest nuclear power facility.
The stolen files did not include any main operational reactor control code or core safety system software.

Hackers failed to break through the isolated main network of government-owned NPCIL. Instead, they accessed the systems of Reliance Infrastructure Ltd, which secured a $112 million engineering contract in 2018.
The targeted information was hosted on a commercial private cloud server managed by Yotta Data Services Private Limited.
Security monitoring software at Yotta detected malware running on a single file server. Technical staff disconnected the system quickly, thinking they had blocked the attack before files were encrypted.
Threat actors from the criminal group World Leaks extracted the data before server disconnection. When the contractor refused their payment demands, the hackers published the 14.3 GB file batch as part of a larger 1.2 TB multi-firm data leak.

The Indian Computer Emergency Response Team (CERT-In) functions as the primary national agency for tracking cyber threats, fixing system flaws, and responding to emergencies.
Key government installations like nuclear reactor controls and ISRO satellite systems remain completely disconnected from the public internet through strict physical network isolation.
The National Cyber Coordination Centre (NCCC) works alongside intelligence teams to gather threat information from international partners and block hackers from compromising central system controllers.
Organizations handling sensitive information must follow cybersecurity requirements under the Information Technology Act, 2000, and the Digital Personal Data Protection (DPDP) Act.

While central government agencies protect their main IT systems well, private sub-contractors and vendor firms often maintain weaker digital security, creating easy entry points for attackers.
Exposing basic engineering designs, cooling pipe routes, and supplier lists gives foreign adversaries the blueprints needed to plan physical or digital attacks.
Foreign state-supported hacker groups continuously target national assets to steal technology, similar to the 2019 DTrack malware attack linked to North Korea.
Modern cybercriminals use multi-stage extortion tactics where they steal information and publish it online, making standard file backup systems useless against exposure.

The government should mandate strict Zero-Trust Architecture security checks for all private engineering partners who work on key public project blueprints.
Engineering documents shared during public contract bidding must have detailed location coordinates removed and feature dynamic security watermarks.
Cybersecurity teams at CERT-In and commercial data centers need automated tools to search networks constantly for hidden data-stealing malware.
Authorities must strictly enforce rules under the DPDP Act that mandate immediate reporting of security breaches to prevent coordination delays between companies and state agencies.

Even though primary reactor controls remained safe behind isolated networks, the exposure of 14.3 GB of structural data reveals significant risks in vendor cybersecurity. Moving forward, India must enforce mandatory and uniform cybersecurity requirements across all private contractors to protect key national infrastructure.