Top News

A ransomware group has published nearly 19,000 files allegedly linked to the Kudankulam Nuclear Power Plant on the dark web after a partial data breach involving contractor Reliance Infrastructure

The leaked documents reportedly include facility blueprints, supplier details and inspection records, raising concerns over the cybersecurity of critical infrastructure and India’s nuclear supply chain

Reliance Infrastructure confirmed a partial breach involving a server hosted by Yotta, while CERT-In is investigating the incident. Reuters could not independently verify the authenticity of the leaked files

Thousands of files linked to the Kudankulam Nuclear Power Plant, India’s largest nuclear power facility, have surfaced on the dark web following a ransomware group claimed to have breached systems belonging to one of the project’s contractors.

As per a Reuters report, ransomware group World Leaks published nearly 19,000 files allegedly to the nuclear power plant. The files include blueprints of parts of the facility, supplier details, inspection records, equipment reviews and insurance documents.

The leaked files were labelled as originating from Anil Ambani-led Reliance Group. The group told Inc42 that there had been a “partial breach” involving data stored on a server hosted by third-party data centre provider Yotta.

Reliance said Yotta informed the company that the suspicious process was identified and terminated immediately, and the incident was contained. It also noted that no ransomware execution, data loss, or lateral movement occurred, and services were restored.

“Yotta has confirmed enhanced security monitoring and preventive controls are now in place. The Company has directed Yotta to conduct a detailed investigation and submit a report. The incident has been reported to CERT-In, and disclosure has been made to the Stock Exchanges under Regulation 30 of the SEBI (LODR) Regulations, 2015,” a Reliance Group spokesperson said.

Inc42 has reached out to Yotta to get responses on the development. The story will be updated based on the comments.

Notably, Reliance Infrastructure secured the contract in 2018 to design and build infrastructure for Units 3 and 4 of the Kudankulam Nuclear Power Plant (KKNPP).

KKNPP operates two 1,000 MW reactors and is executing a massive expansion to house six 1,000 MW Russian-supplied VVER reactors. Units 3 and 4 (2,000 MW) are in advanced stages, while the reactor pressure vessel for Unit 5 was recently installed to target late 2026 commissioning

The leaked files are said to contain blueprints of ventilation and cooling systems for Units 3 and 4, floor layouts of a common control room, approved supplier lists and records of inspections conducted jointly by Reliance and the Nuclear Power Corporation of India (NPCIL).

The cache is also said to include an insurance document showing coverage of up to $112 Mn against terrorism- incidents affecting the units.

Yotta, in a statement to Reuters, said it detected suspicious activity on a server on May 29 and claimed it stopped the suspected ransomware execution immediately.

However, it said Reliance later informed it about claims made by external threat actors that data had been stolen. Yotta added that it has not independently verified those claims but has shared its technical findings with Reliance and is supporting the ongoing investigation.

World Leaks is a ransomware group known for publishing stolen corporate data when victims refuse to pay ransom demands.

Earlier this year, the group also claimed responsibility for leaking data allegedly stolen from Tata Group after demanding a $1.5 Mn ransom.

This is not the first cybersecurity incident linked to the Kudankulam plant. In 2019, malware associated with a North Korean hacker group was detected on the plant’s administrative network, although NPCIL had said at the time that operational systems were not affected.