India Says Leaked Kudankulam-Linked Files Pose No Nuclear Safety Risk
Summary
World Leaks claimed to publish nearly 19,000 Kudankulam-linked files. Reliance reported a partial breach; Yotta detected suspicious activity but has not verified data-theft claims. NPCIL said the files concern non-nuclear systems, not reactor safety.
Key points
- NPCIL said the leaked files appear related to conventional Balance of Plant work and do not concern nuclear safety or security systems.
- World Leaks claimed to publish nearly 19,000 files, reportedly including engineering drawings, supplier information, inspection records and insurance documents.
- Reliance Group reported a partial breach involving data hosted on Yotta, but did not specify what information was accessed.
- Yotta said it detected suspicious activity on a Reliance Infrastructure server in late May and stopped it; it has not independently verified claims that data was stolen.
- The documents’ authenticity and the intrusion method remain unverified. A researcher suggested possible access through exposed remote desktop services, phishing or a Fortinet vulnerability, with no public evidence confirming the vector.
- Officials said there is no evidence reactor systems were compromised; the article also notes that a 2019 malware incident affected an administrative network isolated from reactor control and operational networks.
Article Details
- Victim Organization
- Reliance Infrastructure
- Incident Type
- Reported partial breach involving data hosted on Yotta infrastructure; World Leaks claimed to possess and published purportedly stolen data.
- Data Types Exposed
- Engineering drawings
- Supplier information
- Meeting records
- Inspection reports
- Insurance documents
- Affected Records
- Nearly 19,000 files, according to researcher Rakesh Krishnan; the documents' authenticity could not be independently verified.
- Affected Data Size
- Approximately 14.3 GB, according to researcher Rakesh Krishnan; the figure was not independently verified.
- Operational Impact
- Yotta said it detected and terminated suspicious activity on a Reliance Infrastructure server in late May, preventing what it described as a suspected ransomware execution. No evidence was reported that reactor systems were compromised, and NPCIL said the files did not concern nuclear safety or security systems.
- Ransom Or Extortion
- No ransom demand for this incident was reported. World Leaks claimed to possess stolen data and published files; Yotta said it had not independently verified the external actors' claims.
- Claim Status
- claimed
People
Jitendra SinghScience and Technology Minister who dismissed reports that sensitive nuclear information had been compromised and said there was no immediate need for a broader security review.Rakesh KrishnanIndependent cybersecurity researcher who first documented the purported leak and reported the file count and size; he described possible intrusion vectors, but the article says there is no public evidence confirming the vector.
Threat Actors
Lazarus GroupResearchers later linked malware discovered in 2019 on Kudankulam's internet-connected administrative network to Lazarus Group; this was a prior incident, and the article does not attribute the current breach to the group.World LeaksClaimed responsibility for publishing files purportedly linked to Reliance Infrastructure and Kudankulam. The authenticity of the documents and the group's claim to possess stolen data were not independently verified.