14.3 GB Kudankulam Nuclear Data Leak Exposes Supply Chain Risks for India’s Energy Expansion

For climate and energy professionals, the breach highlights a blind spot in the push for low-carbon baseload power. As India fast-tracks new reactors at Kudankulam, the 14.3 GB data dump reveals how third-party cybersecurity gaps can cascade into strategic risks, potentially delaying reactor deployments and shaking investor confidence in nuclear infrastructure projects.

The discovery of 19,000 files—14.3 gigabytes of data—from India’s Kudankulam Nuclear Power Plant on a dark web portal operated by the ransomware group World Leaks marks a significant escalation in the targeting of critical infrastructure supply chains. The files, attributed to Reliance Group, a key contractor for the plant’s Units 3 and 4, reportedly include construction blueprints, supplier directories, equipment inspection records, and meeting minutes spanning 2016 to 2025. The breach, first identified in June 2026 by cybersecurity researcher Rakesh Krishnan, occurred not on the plant’s operational technology networks but on servers operated by Yotta Data Services, a third-party data center provider used by Reliance Group. This distinction is central to understanding both the incident’s severity and the official response.

“

The files, attributed to Reliance Group, a key contractor for the plant’s Units 3 and 4, reportedly include construction blueprints, supplier directories, equipment inspection records, and meeting minutes spanning 2016 to 2025.

Reliance Group has characterized the incident as a ‘partial breach’ confined to the Yotta-hosted environment and insists its core systems were unaffected. The Nuclear Power Corporation of India Limited (NPCIL) stated categorically that the breach ‘does not relate to any nuclear safety or nuclear security-related systems.’ However, the Washington-based Nuclear Threat Initiative warned that even non-operational data exposure poses a ‘serious’ risk to plant safety, pointing to the potential for adversaries to map plant layouts, identify supply chain dependencies, and plan physical or cyber-physical attacks.

The dichotomy highlights a persistent blind spot in critical infrastructure security: while nuclear operators maintain robust defenses around reactor controls and safety systems, the sprawling ecosystem of contractors, subcontractors, and cloud service providers often operates with far fewer protections. Reliance Infrastructure, a Reliance Group company, won a contract in 2018 to develop infrastructure for Kudankulam Units 3 and 4, which are expected to become operational by 2027. The leaked documents, therefore, likely contain detailed engineering and logistics information tied to these under-construction units, expanding the exposure from current operations to future capacity.

The World Leaks group exemplifies the ransomware-as-a-service model, combining encryption attacks with data exfiltration and public shaming on dark web leak sites when extortion demands aren’t met. The group’s tactics mirror those of well-known ransomware collectives that have increasingly targeted industrial sector vendors. In this case, the data dump appears to stem from a breach at a data center, not through direct infiltration of Reliance’s internal networks, reinforcing the growing risk of downstream cyber incidents across cloud supply chains.

India’s computer emergency response team, CERT-In, is now investigating. The incident arrives amid an ambitious national nuclear energy expansion plan, with Kudankulam—India’s largest nuclear power complex—at its core. The planned addition of Units 3 and 4, with two more units in the pipeline, underscores the strategic importance of the facility. A breach of this nature could not only expose sensitive project data but also erode public confidence and invite heightened regulatory scrutiny, potentially delaying project timelines or increasing compliance costs.

From a threat intelligence perspective, the publication of thousands of files on a public dark web forum gives nation-state and non-state actors alike open-source access to engineering schematics and supplier networks. Even if NPCIL’s statement about no compromise of safety systems is technically accurate, the aggregation of such granular infrastructure data over a nine-year period could enable sophisticated threat actors to identify vulnerabilities or plan social engineering attacks against personnel and vendors.