India's 2,000 MW Kudankulam Nuclear Project Data Leak: NPCIL Says No Safety Risk

For climate and energy stakeholders, the 2,000 MW Kudankulam nuclear expansion represents a cornerstone of India's low-carbon electricity future. A data breach at contractor Reliance Infrastructure, while not compromising nuclear safety, reveals how even non-critical infrastructure data can disrupt clean energy project timelines and erode investor confidence.

On July 16, 2026, the Nuclear Power Corporation of India Limited (NPCIL) issued a public statement clarifying that engineering drawings reportedly leaked through a data breach at Reliance Infrastructure Ltd. pertain solely to conventional Balance of Plant (BoP) facilities for the Kudankulam Nuclear Power Project (KKNPP), and do not involve nuclear safety or security systems. The clarification comes amid media reports of a cyber incident at the EPC contractor, which had been awarded the contract for Units 3 and 4 of the 2,000 MW nuclear project in 2018. NPCIL emphasized that the leaked information covers only common service facilities comparable to those in thermal power plants, and was developed by Reliance Infrastructure in consultation with OEMs, then reviewed and accepted by NPCIL. While the statement aims to allay public fears, the incident raises broader concerns about the cybersecurity of critical infrastructure supply chains.

“

On July 16, 2026, the Nuclear Power Corporation of India Limited (NPCIL) issued a public statement clarifying that engineering drawings reportedly leaked through a data breach at Reliance Infrastructure Ltd.

The KKNPP is one of India’s flagship nuclear energy programs, with Units 3 and 4 representing a significant addition of 2,000 MW to the grid. The EPC contract for the Common Services-BoP package, awarded to Reliance Infrastructure in 2018 via public tender, encompasses engineering, procurement, construction, and commissioning of auxiliary systems—such as cooling water systems, fire protection, and waste management—that support but are not integral to the nuclear reactor core. These systems, while essential for plant operation, are explicitly separated from nuclear safety and security architecture. NPCIL’s insistence on this distinction signals a dual intent: to reassure the public that no radioactive materials or reactor control mechanisms are at risk, and to shield the strategic nuclear program from reputational damage.

From a cybersecurity perspective, however, the fact that the breach occurred at a third-party contractor highlights the persistent vulnerability introduced by interconnected supply chains. Over the past decade, attacks on industrial infrastructure have increasingly targeted less-secured vendors and service providers to gain access to sensitive networks or intelligence. In the nuclear sector, even data on conventional plant systems can offer adversaries insights into plant layout, security perimeters, and operational processes—information that could be leveraged for physical intrusion or social engineering. While NPCIL stated that the drawings were developed from indicative inputs and OEM consultations, meaning they lack proprietary reactor technology details, the exposure still constitutes a security gap that merits thorough investigation.