Film certification records exposed in CBFC data leak, Pg1

Key Highlights:

• The Central Board of Film Certification (CBFC) experienced an alleged data breach, exposing information from over 500 film certification applications.
• The leak reportedly originated from the e-Cinepramaan portal, a digital platform for film certification, with records dating from December 2025 to August 2026.
• Leaked data included commercially sensitive documents such as shooting scripts, cut orders, and local distribution agreements with licensing fees.
• The documents were accessible on the Internet Archive for several days before being taken down on October 12.
• The CBFC has initiated an investigation, filed a complaint with cybercrime authorities, and notified the Indian Computer Emergency Response Team (CERT-In).

Detailed Insights:

• The e-Cinepramaan portal was launched in 2017 to digitize and enhance the transparency and efficiency of the film certification process.
• The exposed records did not include actual feature films but rather application-related materials submitted by filmmakers.
• The user who uploaded the documents used a Russian display name, reportedly corresponding to former CBFC chairman Prasoon Joshi, and the account has since been deleted.
• The CBFC stated that initial examinations found no trace of the claimed accessed documents and that no individual filmmaker's account appeared compromised.
• A thorough security audit of the e-Cinepramaan portal has been committed to by the CBFC to address the alleged breach.
• Such data leaks, especially involving commercial agreements, can be financially damaging and compromise intellectual property rights within the film industry.

Key Concepts Involved:

• Central Board of Film Certification (CBFC): A statutory body under the Ministry of Information and Broadcasting responsible for certifying films for public exhibition in India under the Cinematograph Act, 1952.
• e-Cinepramaan Portal: An online system implemented by the CBFC for the digital application, processing, and issuance of film certificates.
• Indian Computer Emergency Response Team (CERT-In): The national agency established under the Information Technology Act responsible for addressing cybersecurity threats, collecting incident information, and coordinating responses in India.
• Digital Personal Data Protection Act, 2023 (DPDP Act): India's comprehensive data protection law that mandates obligations for data fiduciaries regarding personal data breaches, including notification, with significant penalties for non-compliance.