The Lift Line
“In the digital era, critical infrastructure is not a building surrounded behind a fence; it is a layered system with many access points, many of them are outside the operator’s control.” (Khyati Singh, The Hindu, 27 October 2026)
Why This Editorial Matters for Your Exam
In the news: on 27 October 2026, The Hindu’s lead article “Beyond Kudankulam’s fence, a cybersecurity challenge”, by Khyati Singh, returned to the Kudankulam data leak first reported in July 2026, and asked who protects a critical facility’s data once it leaves the facility.
Khyati Singh is Research Analyst, Centre for North America and Strategic Technologies, MP-IDSA and the author of Cyber Leviathan: Digital Strategies in International Relations. Related reading on this site: The Hindu’s editorial on CERT-In’s advisory on AI agents (21 October), its explainer on the SBI data breach and the DPDP law (25 October) and the FSDC’s 30th meeting and its cyber security strategy (23 October).
GS Paper 3: internal security (basics of cyber security; challenges to internal security through communication networks) and energy infrastructure. GS Paper 2: statutory and nodal bodies such as CERT-In and NCIIPC.
The Crux in 60 Words
Khyati Singh argues that the Kudankulam leak never touched the reactors: the files surfaced from a contractor’s server in a commercial data centre. India’s rules, the author writes, place duties on the operator, while sensitive project data now passes through contractors, subcontractors and hosts bound mainly by contracts. The author’s remedy: security obligations that follow the data, under one national framework.
Khyati Singh argues that the Kudankulam leak happened outside the plant, on a contractor’s hosted server, and shows that India’s cyber rules for critical infrastructure stop at the operator while sensitive project data now travels through many private hands.
- The author accepts that nothing in the public domain shows the reactors or their control and safety systems were accessed; the author’s concern is how much operationally relevant information sits with contractors, subcontractors, service providers and their staff.
- The author reads 2019 and 2026 as one pattern: the core held both times, and the exposure was at the periphery, first an Internet-facing administrative network and now a contractor’s server in a commercial data centre.
- In the author’s reading, a protected system belongs to an infrastructure and its obligations fall on the operator, so data shared down the supply chain is protected largely by contracts; the DPDP Act, the author adds, does not generally cover technical drawings without personal data.
- The operator, the contractor and the host can each truthfully deny fault while the files still reach the dark web, and the gap widens as the plant expands and more private firms enter defence, space, grids and cloud.
NPCIL says the material relates only to conventional Balance of Plant common service facilities and not to any nuclear safety or security system; Reuters could not verify the files; and the IT Act already lets CERT-In give directions to data centres and service providers, so better use of existing powers and contracts may close much of the gap without a new law.
Make security obligations follow the data through procurement contracts with liability and audit; classify data so contractors hold only what they need for as long as they need it; replace annual compliance certificates with third-party risk assessment and red-team tests; adopt zero-trust for projects of national importance; and let CERT-In, NCIIPC, sectoral regulators and operators converge on one national supply-chain framework.
Background and Context
The leak, as reported in July
On 15 July 2026, Reuters reported that the ransomware group World Leaks had posted on the dark web “a huge cache of files related to India’s largest nuclear plant, including purported blueprints of parts of its facilities and supplier details”, labelled as coming from Reliance Group.
- Size and timing: nearly 19,000 files, 14.3 GB, online since 11 June, according to independent cybersecurity researcher Rakesh Krishnan, who first alerted Reuters.
- Contents: documents dated 2016 to mid-2025, which Reuters reviewed “but could not verify their authenticity”: purported blueprints for the ventilation and cooling systems of Units 3 and 4 and the floor layout of a “common control room”. They did “not appear to relate to the nuclear reactors’ core systems, which are supplied by Russia’s state-owned Rosatom.”
- The contractor: Reliance Group told Reuters of a “partial breach” of its data on a server hosted by the third-party Indian data centre provider Yotta, and said the government had been informed; it did not disclose what data was breached.
- The host: Yotta said it noted “suspicious activity” on 29 May on a server it hosts for Reliance Infrastructure, terminated the activity at once and prevented the suspected ransomware execution. At the end of June, Reliance Infrastructure told it of breach claims by “external threat actors”, which Yotta has not been able to verify.
- The agency: CERT-In was looking into the incident, according to a source cited by Reuters.
NPCIL’s position, in its own words
The Nuclear Power Corporation of India Limited (NPCIL), which runs the plant, said in a press release the same day, as quoted by Business Today: “NPCIL reiterates that the information claimed to be available in the public domain pertains only to conventional Balance of Plant (BoP) common service facilities and does not relate to any nuclear safety- or nuclear security-related systems or information.” It said the Engineering, Procurement and Construction (EPC) contract for the Common Services-Balance of Plant package was awarded to Reliance Infrastructure in 2018 through a public tendering process.
2019: the first warning
In a statement reported on 30 October 2019, NPCIL said CERT-In had told it on 4 September 2019 of malware at Kudankulam. DAE specialists found that “the infected PC belonged to a user who was connected in the internet-connected network used for administrative purposes”, which “is isolated from the critical internal network”, and that “the plant systems are not affected”. NPCIL did not name the malware; researchers identified it as Dtrack, spyware reportedly developed by the North Korea-based group Lazarus. The plant’s information officer had first called the reports “baseless”.
The plant
Kudankulam is in Radhapuram taluk, Tirunelveli district, Tamil Nadu. NPCIL runs two 1,000 MWe pressurised water reactors (PWRs) there, in commercial operation since 31 December 2014 (Unit 1) and 31 March 2017 (Unit 2). Its project pages describe Units 3 and 4 and Units 5 and 6, each pair of 2 x 1,000 MW, as under construction with technical cooperation from the Russian Federation; six such units make the 6,000 MW the author cites. Reuters reported in July that Units 3 and 4 were due to be operational by 2027.
The Analysis
Khyati Singh builds the case in five moves.
1. A breach outside the fence, not a reactor hack. “The most consequential breach may never touch the facility at all,” Singh writes; it can happen “in a rented server in a commercial data centre or even within a contractor’s network”, as appears to have been the case here. The author keeps the caveats: ransomware groups “routinely inflate what they hold”, and “Nothing in the public domain indicates that the reactors or control and safety systems, isolated from the Internet by design, were accessed.” NPCIL’s clarification, the author says, should be taken seriously. The author’s question is how much operationally relevant information about India’s most sensitive facilities sits with contractors, subcontractors, service providers and their employees.
2. 2019 and 2026 as one pattern. The two incidents “are not technically connected, but there is a link”: in both, “the core held and the exposure was at the periphery”, first an administrative network, now a contractor’s server in a commercial data centre. The latest incident, the author concludes, suggests that the lesson of 2019 was not taken seriously.
3. The ecosystem is the attack surface. A modern plant, grid, defence facility or telecom system relies on private builders, equipment and software suppliers, cloud and data-centre providers, insurers, certification agencies and layers of subcontractors, many of them foreign technology partners. Their copies of drawings, purchase orders, credentials and schedules sit outside the facility’s own protections (network segmentation, air-gapped control systems, physical security). Hence The Hindu’s pull-quote from the article: “An organisation’s security depends not only on its own safeguards but also on those of every other entity that has access to its data”. The author cites Nickolas Roth, whom Reuters identifies as a senior director at the Nuclear Threat Initiative; Reuters quoted Roth as saying the files could “show an adversary not just who has access to the project but which systems that access reaches”.
4. The duty stops at the operator. The institutions exist (see the box above); the gap, in the author’s reading, is that “a “protected system” belongs to an infrastructure, and the obligations fall on its operator”. Once project information passes to a contractor, a subcontractor or a data centre, “its protection depends largely on contractual arrangements”, and the Digital Personal Data Protection Act, the author adds, does not generally cover engineering drawings that hold no personal data. So “The operator can truthfully say that its systems were not breached, the contractor can blame its hosting provider”, the host can blame the malware, and the files still reach the dark web. The author’s key question is “who is responsible for protecting critical infrastructure information once it leaves the operator’s control”. The stakes rise as India expands Kudankulam, builds smart grids and digital public infrastructure, opens defence and space to private firms under Atmanirbhar Bharat, and moves government data to commercial cloud: a policy designed “for a system in which the government builds and controls everything”, the author argues, “is no longer adequate”.
5. The remedies.
- Obligations follow the data: “security obligations must follow the data, not the organisation”, with defined standards, liability and audit written into the procurement contract of every contractor, subcontractor and cloud provider handling critical infrastructure data.
- Real data classification: a contractor building a conventional facility holds only the data it needs, for only as long as it needs it.
- Test the ecosystem: third-party risk assessment, including red-team exercises on the vendor ecosystem, in place of annual compliance certificates.
- Zero-trust: assume no network is safe and verify every access point on projects of national importance.
- One framework: CERT-In, NCIIPC, sectoral regulators and operators converge on a single national framework for critical-infrastructure supply-chain security that assigns responsibility before a breach rather than after. Whether through new legislation or “a creative reading of the IT Act”, the author says, “can wait”.
Where the record adds detail. The article says World Leaks began posting the files in mid-July; Reuters, citing Rakesh Krishnan, said they had been online since June. It says Yotta “confirmed ransomware activity”; Yotta’s own statement speaks of “suspicious activity” and a suspected ransomware execution that was prevented. And where the article calls Reliance Infrastructure’s contract the EPC contract for Units 3 and 4, NPCIL describes it as the EPC contract for the Common Services-Balance of Plant package.
Data and Institutions Vault
Prelims-grade facts:
The law (IT Act, 2000):
- Section 70: the appropriate Government may notify a computer resource affecting CII as a protected system; unauthorised access: up to 10 years’ imprisonment and fine.
- Section 70A: the Government may designate a national nodal agency for CII protection; NCIIPC was set up under it.
- Section 70B: CERT-In, the national agency for responding to cyber security incidents.
- CERT-In may call for information from and give directions to service providers, intermediaries, data centres and body corporates (Section 70B(6)).
- Not complying with CERT-In: up to one year in prison, or a fine up to ₹1 lakh, or both (Section 70B(7)).
- CERT-In Directions of 28 April 2022: report cyber incidents within 6 hours of noticing them; effective 60 days after issue.
The plant:
- Kudankulam, Tirunelveli district, Tamil Nadu; run by NPCIL.
- Units 1 and 2: PWRs of 1,000 MWe each, in commercial operation from 31 December 2014 and 31 March 2017.
- Units 3 and 4 and Units 5 and 6: each pair 2 x 1,000 MW, built with technical cooperation from the Russian Federation.
The 2026 leak:
- First reported on 15 July 2026 (Reuters); group: World Leaks; nearly 19,000 files, 14.3 GB; online since 11 June.
- Yotta: “suspicious activity” on 29 May; NPCIL: only “conventional Balance of Plant (BoP) common service facilities”.
2019:
- CERT-In alerted NPCIL on 4 September 2019; the infected PC was on the administrative network; researchers named the malware Dtrack, linked to Lazarus.
⚠️ Watch the trap: NCIIPC is Section 70A and CERT-In is Section 70B, not the other way round. NPCIL says the material concerned conventional Balance of Plant facilities, not reactor, safety or security systems. The DPDP Act is a personal-data law; it is not a law on critical infrastructure.
The Debate
The case for the author’s reading. Each July statement covers only its own link of the chain: NPCIL what the material concerned, Reliance a partial breach on a hosted server, Yotta activity it had stopped. That is the accountability gap the author describes. Both the 2019 and the 2026 episodes hit the periphery, and the private share of nuclear power, grids, defence, space and cloud is growing.
The other side. NPCIL says the material concerned only conventional Balance of Plant common service facilities, not any nuclear safety or security system; Reuters said the documents did not appear to relate to the reactors’ core systems, and could not verify them; and ransomware groups, as the author concedes, inflate their claims. The law is not empty either: Section 70B lets CERT-In call for information from and give directions to data centres and service providers, and its 2022 directions already make them report incidents. Contracts can carry standards, audits and liability today, and the author leaves open whether a new law is needed at all. Each new compliance layer is also a cost for the private firms the government wants in these sectors, so duties should match the sensitivity of the data.
The balanced verdict. Both can hold. The reactors are not shown to be at risk, and NPCIL’s account deserves weight. But purported drawings of ventilation, cooling and a common control room, with supplier details, can tell an adversary, in Roth’s words, “who has access to the project” and “which systems that access reaches”. The author’s remedies are mostly procedural (contracts, classification, testing), which makes them achievable; the open question is which body owns the framework.
How to Think About This
Use a “follow the data, not the fence” lens for any breach at a critical facility (a power plant, a port, a bank, a telecom network):
- What was touched? Control and safety systems, an office network, or a copy of documents held elsewhere? (Kudankulam 2019: the administrative network; 2026: files from a contractor’s hosted server.)
- Who held it? Operator, contractor, subcontractor, data centre: each is a separate organisation with its own security.
- Which rule reaches that holder? A notified protected system (Section 70), CERT-In’s reporting and directions (Section 70B), the DPDP Act (personal data only), or only a contract?
- Who said what? Keep the operator’s, the contractor’s and the host’s statements apart, and all of them apart from a ransomware group’s claims; the legal reading and the remedies are the author’s.
Diagram-in-Words
Beyond Kudankulam’s fence: where the data sat
Files said to relate to the project appear to have moved from the operator to a contractor, a hosted server and the dark web; Khyati Singh reads the gap and proposes a fix.
Read it from the top: the core held, in the author’s words, while project files moved out through the contractor and its host to the dark web. The last row gives the gap as the author reads it, and the author’s remedy.
Critical infrastructure is now exposed through the contractors, subcontractors and data centres that hold its information, not only at the operator's perimeter. Examine the gaps in India's legal and institutional framework for this supply-chain risk and suggest measures. (250 words)
Critical information infrastructure (CII) is defined in Section 70 of the Information Technology Act, 2000 as computer resources whose incapacitation or destruction would have a debilitating impact on national security, economy, public health or safety. India built its protection around the operator’s own systems, but CII data now passes through contractors, subcontractors and commercial data centres, and that is where the newer risks sit.
Framework. Section 70 lets the appropriate Government notify a computer resource as a protected system, with up to ten years’ imprisonment for unauthorised access, and the Central Government prescribes its security practices through the IT (Information Security Practices and Procedures for Protected Systems) Rules, 2018.
The National Critical Information Infrastructure Protection Centre (NCIIPC), set up under Section 70A, is the nodal agency for CII protection. CERT-In, under Section 70B, responds to incidents, can give directions to service providers, intermediaries and data centres, and requires cyber incidents to be reported within six hours under its 2022 Directions.
Gaps. These duties centre on notified systems and on incident reporting; the confidentiality of project data held by a contractor or its host rests mainly on contracts, and the Digital Personal Data Protection Act deals with personal data, not engineering drawings.
Practice. In 2019 malware was found on an Internet-connected administrative network at Kudankulam, isolated from the plant’s critical internal network.
In July 2026 Reuters reported that files said to relate to the project were on the dark web; NPCIL stated that they pertained only to conventional Balance of Plant common service facilities, while the contractor reported a partial breach on a server hosted by a third-party data centre. Each link spoke only for its own systems.
Security duties should travel with the data: procurement contracts carrying standards, liability and audit; data classification and minimisation; third-party risk assessment and red-team exercises in place of annual certificates; zero-trust architecture for projects of national importance; and a single national framework for critical-infrastructure supply-chain security, shared by CERT-In, NCIIPC, sectoral regulators and operators, that assigns responsibility before a breach rather than after.
Interview Angle
"A contractor on a nuclear power project loses project drawings from a hosted server, and the operator says its own systems were never breached. Who should answer for the leak, and what would you change in the next contract?"
Takeaway Box
- Lift line: “In the digital era, critical infrastructure is not a building surrounded behind a fence; it is a layered system with many access points, many of them are outside the operator’s control.”
- Core idea: the Kudankulam files surfaced from a contractor’s hosted server, not the plant; the author says India’s rules bind the operator while its data travels through private hands.
- Prelims hooks: IT Act Section 70 (CII, protected system), 70A (NCIIPC), 70B (CERT-In); CERT-In reporting directions; Kudankulam in Tirunelveli, Tamil Nadu, run by NPCIL with Russian cooperation; Dtrack (2019).
- Ethics and Interview angle: accountability in outsourcing: when each party can truthfully deny fault, who owns the risk?
- Probable question: “Explain the roles of CERT-In and NCIIPC in protecting India’s critical information infrastructure.” (GS3, 150 words)
Sources:
- “Beyond Kudankulam’s fence, a cybersecurity challenge”, Khyati Singh, lead article, The Hindu, 27 October 2026
- Reuters report on the Kudankulam data leak, by Munsif Vengattil and Aditya Kalra, 15 July 2026 (syndicated copy)
- NPCIL press release of 15 July 2026, as reported by Business Today and DT Next, 15 July 2026
- NPCIL statement on the 2019 malware, as reported by The News Minute, 30 October 2019
- Information Technology Act, 2000 (India Code, updated text), Sections 70, 70A and 70B
- CERT-In Directions No. 20(3)/2022-CERT-In under Section 70B, 28 April 2022
- PIB, Ministry of Electronics and IT, 28 March 2025; Lok Sabha Unstarred Question 4138, answered 12 August 2026
- NPCIL, Kudankulam Nuclear Power Project pages
Cite this page: Kudankulam Data Breach: Beyond the Fence, Supply-Chain Risk — Ujiyari.com | Free UPSC & State PCS Editorial Analysis
