India's Largest Nuclear Plant Hit by Data Leak; Blueprints of Kudankulam Nuclear Plant Leaked On Dark Web

A ransomware group has claimed to have leaked thousands of files linked to the Kudankulam Nuclear Power Plant in Tamil Nadu, India's largest nuclear power facility, Reuters reported.

The cybercriminal group World Leaks published a cache of files on the dark web, claiming they were obtained from Anil Ambani-led Reliance Group, one of the contractors involved in the Kudankulam project. The leaked material allegedly includes engineering drawings, supplier information, inspection records and insurance documents.

Reliance Group admitted that it had suffered a "partial breach" involving data stored on servers managed by third-party data centre provider Yotta. The company said the incident had been reported to the government but did not specify what information may have been compromised.

Reuters said it examined the leaked files, which are dated between 2016 and mid-2025, but could not independently confirm whether the documents are genuine.

Among the documents reviewed were what appeared to be blueprints for ventilation and cooling systems serving Units 3 and 4 of the plant, along with floor plans of a common control room. The files also reportedly contain vendor proposals, approved supplier lists, inspection reports and photographs from a joint site visit by Reliance and the Nuclear Power Corporation of India (NPCIL) in 2024.

One document reportedly refers to an insurance policy worth $112 million covering terrorism-related damage to the two under-construction reactor units.

However, the leaked documents do not appear to involve the reactors' core systems, which are supplied separately by Russia's state-owned Rosatom.

A source familiar with the matter told Reuters that NPCIL has been coordinating with Reliance following the breach and that the Indian Computer Emergency Response Team (CERT-In) is investigating the incident.

Yotta said it detected suspicious activity on a Reliance Infrastructure server on May 29 and immediately stopped what it believed was an attempted ransomware attack. The company said Reliance later informed it that external threat actors were claiming to possess stolen data. While Yotta said it has not independently verified those claims, it has shared the findings of its technical investigation with Reliance and is assisting with the ongoing probe.

Nickolas Roth, Senior Director at the Nuclear Threat Initiative, told the English publication that such information could help attackers understand support systems, identify contractors and expose potential weak points in the project's broader security chain.

World Leaks is known for publishing stolen corporate data after victims refuse to pay ransom demands. The group has previously targeted Tata Group and claimed to possess confidential files related to Apple and Tesla suppliers.