Data breach at Kudankulam nuclear plant: NPCIL confirms no impact on core systems
New Delhi: The Nuclear Power Corporation of India Ltd (NPCIL) and Reliance Infrastructure have confirmed a cybersecurity incident involving data related to the Kudankulam nuclear power plant in Tamil Nadu. However, both entities assert that the breach did not affect core systems related to nuclear safety or security.
The incident came to light after the ransomware group World Leaks posted a large cache of files on the dark web, claiming a data breach. The files appear to be related to infrastructure contracts for the plant's units 3 and 4, awarded to Reliance Infrastructure in 2018.
A Reliance Group spokesperson said the company was informed by Yotta Data Services Private Limited, its third-party data centre service provider, of a ransomware attack that partially breached data hosted on one of Yotta's servers. Yotta identified and terminated the suspicious process immediately, contained the incident, and restored services without any data loss or lateral movement. Enhanced security measures have been implemented, and a detailed investigation is underway.
NPCIL executive director Prateek Agrawal stated that the leaked files are not related to nuclear safety or security systems. The engineering, procurement and construction (EPC) contract for common services, awarded to Reliance Infrastructure, is of a conventional nature, similar to those found in thermal power plants and other process industries. The designs provided by Reliance were based on indicative drawings and technical specifications shared during the tendering process, and were reviewed and approved by NPCIL.
NPCIL reiterated that the information in the public domain pertains only to conventional balance of plant common service facilities and does not involve any nuclear safety or security-related systems.
The Kudankulam nuclear plant, with a capacity of 6,000 MW, is India's largest nuclear facility. Units 1 and 2 are operational, while units 3, 4, 5, and 6 are under various stages of construction and commissioning. The incident has been reported to the Indian Computer Emergency Response Team (CERT-In) and disclosed to stock exchanges as required by SEBI regulations.
