19,000 files in Kudankulam breach, but 'no nuclear safety risk' — government

Nuclear energy is a cornerstone of global decarbonization efforts, and India's ambitious nuclear program is critical to its climate commitments. Even a limited breach at its largest plant can cast doubt on the security of future projects, potentially slowing investment and regulatory approvals.

On July 15, 2026, reports surfaced that the ransomware group World Leaks had exfiltrated over 19,000 files linked to the Kudankulam Nuclear Power Plant (KKNPP) in Tamil Nadu, India's largest nuclear facility. The documents, spanning from 2016 to mid-2025, included engineering specifications, vendor details, and meeting records. By July 16, Union Science Minister Jitendra Singh and plant operator Nuclear Power Corporation of India Limited (NPCIL) had issued coordinated denials, asserting that no data related to nuclear safety or security was compromised. The leaked material, they claimed, pertained only to the conventional Balance of Plant (BoP) package—the engineering, procurement, and construction contract for common service facilities that are typical of any thermal industrial plant.

“

On July 15, 2026, reports surfaced that the ransomware group World Leaks had exfiltrated over 19,000 files linked to the Kudankulam Nuclear Power Plant (KKNPP) in Tamil Nadu, India's largest nuclear facility.

This rapid containment narrative is crucial for India's nuclear ambitions. Kudankulam, with its six Russian-designed VVER-1000 reactors, is a flagship of India's civil nuclear partnership with Russia. Units 1 and 2 are operational, units 3 and 4 are under construction with a 2027 target, and the remaining two are planned. The BoP contract was awarded to Reliance Infrastructure Limited through a public tender in 2018, a fact that now places a major private-sector contractor squarely at the center of a contentious cyber incident. While NPCIL's distinction between nuclear safety systems and conventional auxiliary services is technically accurate, the breach exposes significant vulnerabilities in the extended supply chain of critical national infrastructure.

The group World Leaks is a relatively new but aggressive player in the ransomware-as-a-service ecosystem, known for targeting industrial sectors. The sheer volume of exfiltrated data—19,000 files over nearly a decade—suggests a persistent, possibly long-term access compromise. Even if the documents do not contain reactor core designs or control system schematics, the cache includes engineering drawings of cooling and ventilation layouts, vendor lists, and meeting minutes. For a determined adversary, such information is a treasure trove for social engineering, physical intrusion planning, or mapping dependencies for future cyber-physical attacks. The incident echoes earlier nuclear-sector breaches, such as the 2019 Kudankulam incident attributed to North Korean Lazarus group, but with the added dimension of a ransomware extortion play.

From a policy perspective, the Indian government's swift dismissal of safety risks may be aimed at preserving investor and public confidence at a time when nuclear energy is being positioned as a cornerstone of climate commitments. However, the breach challenges the narrative that nuclear facilities can be air-gapped or isolated from broader IT threats. The BoP contract involves extensive IT/OT integration for cooling systems, fire protection, and wastewater treatment—systems that, while conventional, are often connected to plant networks. A compromise in these areas could be leveraged as a stepping stone to more sensitive systems.