Bengaluru: Ransomware group World Leaks has published a large cache of files on the dark web that it claims are linked to India's largest nuclear power plant, including alleged blueprints of parts of the facility and supplier information. The group labelled the data as originating from Reliance Group, reported Reuters.
The Kudankulam Nuclear Power Plant in Tamil Nadu is the largest among India's seven nuclear power stations and plays a key role in Prime Minister Narendra Modi's plans to significantly expand the country's nuclear energy capacity.
Reliance Group, headed by industrialist Anil Ambani and one of the contractors involved in the project, acknowledged a "partial breach" of its data hosted on a server operated by third-party data centre provider Yotta. In a statement to Reuters, the company said the government had been informed about the incident but did not specify what information had been compromised.
According to Nickolas Roth, Senior Director at the Nuclear Threat Initiative, the breach could pose a "serious" risk to the safety of the nuclear facility. He said the incident also highlights the growing frequency of cyberattacks in India, where many organisations remain inadequately prepared to tackle such threats.
Independent cybersecurity researcher Rakesh Krishnan, who first alerted Reuters to the leak, said nearly 19,000 files totalling 14.3 GB associated with the search term "KKNP" — an acronym for the Kudankulam Nuclear Power Plant — have been publicly available online since June 11.
Reuters reviewed the documents, dated between 2016 and mid-2025, but said it could not independently verify their authenticity. The files allegedly include blueprints, supplier details, meeting and inspection records, equipment assessments and insurance documents.
The 19,000 files appeared to be the most sensitive portion of around 858,000 Reliance-related files uploaded to the World Leaks website.
Reliance Infrastructure, a subsidiary of Reliance Group, secured a contract in 2018 to design and construct infrastructure for Units 3 and 4 of the Kudankulam project. The two reactors, which remain under construction, are expected to become operational by 2027 and together add 2,000 megawatts of electricity generation capacity.
World Leaks, a ransomware group known for previously targeting companies including Nike and Tata Group, did not respond to Reuters' queries regarding the alleged Reliance breach. The group typically publishes stolen corporate data after companies refuse to pay ransom demands, and its website is accessible only through a specialised browser.
In June, World Leaks told Reuters it had demanded $1.5 million from Tata Group in exchange for files containing confidential component designs belonging to Apple and Tesla clients, adding that it released the data after Tata "ignored" its demand.
Probe underway
According to a source familiar with the matter, the Nuclear Power Corporation of India (NPCIL), which operates the country's nuclear power plants, has been coordinating with Reliance regarding the breach, while the Indian Computer Emergency Response Team (CERT-In) has launched an investigation. The source requested anonymity because of the sensitivity of the issue.
NPCIL Chairman Rajesh Veeraraghavan, CERT-In and the government's Press Information Bureau did not respond to repeated requests for comment.
Yotta said it detected suspicious activity on May 29 on a server hosting Reliance Infrastructure's data. The company stated that the activity was immediately halted and that the suspected ransomware execution was prevented. However, it said Reliance Infrastructure informed it only at the end of June that "external threat actors" had claimed responsibility for a data breach.
Yotta said it has been unable to verify those claims but has shared the findings of its technical investigation with Reliance Infrastructure and continues to support the ongoing probe.
India's Department of Atomic Energy declined to comment, while Prime Minister Narendra Modi's Office did not respond to Reuters' queries.
Alleged blueprints and insurance records
The leaked files do not appear to involve the core systems of the nuclear reactors, which are supplied by Russia's state-owned Rosatom.
However, the documents allegedly include blueprints of the ventilation and cooling systems for Units 3 and 4, along with what appears to be the complete floor plan of a common control room.
The cache also reportedly contains vendor proposals, an approved supplier list, records of a 2024 joint inspection conducted by NPCIL and Reliance, and photographs of equipment reviewed during the inspection.
Another document appears to indicate that Reliance Infrastructure and NPCIL had taken an insurance policy worth $112 million covering Units 3 and 4 against acts of terrorism.
Cybersecurity researchers said such information, if accessed by malicious actors, could potentially be used to map the plant's support infrastructure, identify suppliers and detect vulnerabilities in the security chain.
The documents could "show an adversary not just who has access to the project but which systems that access reaches," Roth said.
According to cybersecurity company Surfshark, India ranked third globally in data breaches last year, with 28.9 million accounts compromised, behind only the United States and France.
A report released last year by the Data Security Council of India and cybersecurity firm Seqrite found that among 204 organisations surveyed, 73% were "unaware if they have ever been attacked", while 57% lacked basic cyber hygiene practices.
