Kudankulam Nuclear Plant Data Leak Sparks Security Concerns

SUBJECT: Internal Security | Cyber Security | Critical Infrastructure Security

Context

A ransomware group, World Leaks, reportedly accessed over 19,000 sensitive files related to the Kudankulam Nuclear Power Plant (KKNPP) through the server of Reliance Infrastructure, a contractor involved in the construction of Reactors 3 and 4.

The leaked documents reportedly cover the period 2016 to mid-2025 and include:

• Engineering blueprints
• Cooling and ventilation system designs
• Vendor information
• Infrastructure-related technical documents

While officials described the incident as causing “absolute commotion”, the Nuclear Power Corporation of India Limited (NPCIL) clarified that the compromised information relates only to conventional balance-of-plant common service facilities, and nuclear safety and security systems remain unaffected.

Investigations are being carried out by NPCIL and CERT-In.

---

Why is this Incident Significant?

Although reactor control systems were reportedly not compromised, experts warn that leaked infrastructure information could help hostile actors:

• Map support infrastructure around the nuclear facility.
• Identify operational vulnerabilities.
• Plan future cyber or physical attacks.
• Target contractors within the nuclear supply chain.

The incident once again highlights the growing cyber threats facing India’s critical infrastructure.

---

Background

• Suspicious activity was first detected on 29 May 2026.
• The breach became public in late June.
• The incident occurred through a contractor’s server rather than NPCIL’s core operational systems.

Earlier Cyber Attack (2019)

KKNPP had earlier suffered a malware attack linked to the North Korean Lazarus Group.

NPCIL clarified at that time that:

• Only the administrative network was affected.
• Operational reactor control systems remained isolated through air-gapped architecture.

---

Who is Responsible for Nuclear Plant Security?

Nuclear Power Corporation of India Limited (NPCIL)

Primary responsibility for:

• Physical security
• Operational safety
• Cybersecurity of commercial nuclear plants

Department of Atomic Energy (DAE)

Provides:

• Policy direction
• Cybersecurity guidelines

Atomic Energy Regulatory Board (AERB)

Responsible for:

• Regulatory oversight
• Nuclear safety standards
• Security compliance

CERT-In

Provides:

• Incident response
• Cyber forensic investigation
• Technical assistance
• National cyber coordination

---

What is Ransomware?

Ransomware is a type of malware that encrypts files or locks computer systems and demands payment in exchange for restoring access.

Modern ransomware attacks increasingly combine data theft with extortion.

---

Evolution of Ransomware

Early Ransomware

• Encrypted files
• Demanded payment for the decryption key

Modern Ransomware

Double Extortion

Attackers:

• Encrypt data
• Threaten to publicly release stolen data if ransom is not paid

Triple Extortion

Attackers additionally:

• Target customers
• Target suppliers
• Pressure business partners using stolen information

---

Types of Ransomware

Encrypting (Crypto) Ransomware

• Encrypts files
• Requires payment for decryption

Screen-Locking Ransomware

• Locks the device
• Prevents users from accessing the system

Leakware (Doxware)

• Steals sensitive information
• Threatens public disclosure

Mobile Ransomware

• Targets smartphones and tablets

Wipers

• Destroy or permanently erase data

Scareware

• Uses fake alerts and fear tactics to coerce victims into paying

---

Why is Ransomware a Major Threat?

Financial Impact

According to IBM’s Cost of a Data Breach Report 2024:

• Average cost of a data breach in India reached approximately ₹19.5 crore (US$2.35 million).
• Industrial organisations were among the worst affected.

Faster Attacks

Cybersecurity reports indicate that attackers can deploy ransomware within four days after gaining initial network access, leaving very little time for detection and response.

---

Steps to Respond to a Ransomware Attack

Immediate Isolation

• Disconnect infected systems from the network.
• Prevent lateral movement.

Identify the Entry Point

• Examine security logs.
• Analyse alerts.
• Identify the ransomware variant.

Restore Critical Services

• Prioritise essential systems.
• Recover from secure offline backups.
• Use verified decryption tools where available.

Eradicate the Threat

• Remove malware.
• Patch vulnerabilities.
• Strengthen network security before reconnecting systems.

---

Kudankulam Nuclear Power Plant (KKNPP)

Location

• Tirunelveli district, Tamil Nadu

Developed By

• Nuclear Power Corporation of India Limited (NPCIL)
• Russia’s Atomstroyexport

Reactor Type

• VVER-1000 Pressurised Water Reactors (PWR)

Planned Capacity

• 6 reactors
• Total installed capacity: 6,000 MW

Present Operational Capacity

• 2,000 MW (Units 1 & 2)

KKNPP is India’s largest operational nuclear power complex.

---

Historical Evolution

1988

• Indo-Soviet agreement signed by Rajiv Gandhi and Mikhail Gorbachev for two reactors.

1991–1998

• Project delayed following the dissolution of the Soviet Union and Nuclear Suppliers Group restrictions.

1998

• India-Russia cooperation revived.

2002

• Construction officially commenced.

2004

• Dedicated port established to transport heavy reactor equipment.

2017

• Construction of Units 3 and 4 accelerated after regulatory approvals.

2021

• Construction of Units 5 and 6 began.

Expected completion of all six units: 2026–2027.

---

Reactor Status