Kudankulam Nuclear Plant Faces Data Breach, Second Cyber Incident Since 2019

A data breach has exposed information linked to the Kudankulam Nuclear Power Plant (KKNP), India's flagship nuclear project in Tamil Nadu's Tirunelveli district. For nearly a month, documents purportedly related to the plant—including engineering drawings, inspection records, minutes of meetings, technical reports, and official correspondence—have been circulating on the dark web after being leaked by the ransomware group World Leaks.

The Nuclear Power Corporation of India Ltd (NPCIL), which operates the plant, has downplayed the leak, stating that the documents pertain only to non-critical facilities outside the 'reactor island' and pose no risk to nuclear safety. The reactor island is the central, highly protected section where all nuclear processes and critical safety operations occur.

This breach has renewed cybersecurity concerns over India's critical and strategic infrastructure, especially as the government begins opening the tightly regulated civil nuclear sector to private participation. The incident also draws attention because it is not the first cyber incident linked to the Kudankulam plant. In 2019, malware attributed to a North Korean hacking group was detected within the plant's administrative network.

The 2019 cyber incident also affected the Indian Space Research Organisation (ISRO). The breach became public on October 28, 2019, after plant data appeared on virustotal.com, an online malware scanning service. Investigations by multiple cybersecurity agencies attributed the intrusion to DTrack malware, linked to the North Korea-backed Lazarus Group, which typically advances Pyongyang's interests.

According to cybersecurity analysts, DTrack belongs to the same malware family linked to a 2016 cyberattack on an Indian private bank's ATM network, which forced the replacement of an estimated 2.9-3.2 million compromised debit and credit cards. The DTrack malware reportedly targeted the 'domain controller' of KKNP's online network, exposing credentials such as passwords. A domain controller is a central server that verifies the authenticity of all other devices on the network.

Following the 2019 intrusion, Seoul-based IssueMakersLab, an expert group of malware analysts, claimed the attack aimed to steal information on India's thorium-based nuclear power technology, which Indian scientists have been developing for decades. According to IssueMakersLab, the primary entry point was a group of senior Indian nuclear scientists who continued using official institutional email accounts after retirement. Attackers sent malware-laced links to their official and personal email accounts. Once opened while connected to the Kudankulam plant's network, the malware spread through IT systems. IssueMakersLab also claimed the attackers had prior knowledge of the plant's IP network.

Official findings on the 2019 breach have been limited. A day after the information became public, KKNP officials initially denied any cyber-attack, saying the plant's control system is standalone. However, NPCIL later admitted an intrusion and stated that specialists investigated the matter.