Beyond Kudankulam’s fence, a cybersecurity challenge, Pg6

Key Highlights:

• A data breach involving nearly 19,000 files related to the Kudankulam Nuclear Power Plant was reported on July 15, 2026.
• The leaked material, spanning 2016-2025, included engineering drawings and supplier information, posted by the "World Leaks" group.
• The breach originated from a server at Yotta, a third-party data center used by Reliance Infrastructure, a contractor for KNPP Units 3 and 4.
• Nuclear Power Corporation of India Limited (NPCIL) clarified that the information pertained to non-nuclear infrastructure and did not affect nuclear safety systems.
• The incident highlights significant vulnerabilities in India's critical infrastructure cybersecurity due to reliance on third-party supply chains.

Kudankulam Data Breach.jpg

Detailed Insights:

• The breach underscores that cybersecurity risks for critical infrastructure extend beyond the physical perimeter to contractors' networks and commercial data centers.
• This incident follows a 2019 Dtrack malware infection on KNPP's administrative network, which was attributed to North Korea's Lazarus Group.
• Modern critical infrastructure relies on a complex ecosystem of public and private entities, each potentially holding sensitive data not protected by the main facility's security.
• Existing cybersecurity governance bodies like CERT-In and NCIIPC and laws such as the Information Technology Act have limitations in ensuring uniform protection across the supply chain.
• The Digital Personal Data Protection Act does not generally cover technical information like engineering drawings, creating accountability gaps for non-personal data breaches.
• India's expansion of critical infrastructure and initiatives like Atmanirbhar Bharat increase reliance on private entities, amplifying supply chain cyber risks.
• Recommendations include making security obligations follow the data, implementing real data classification, conducting third-party risk assessments, and adopting a zero-trust policy.

Key Concepts Involved:

• Critical Information Infrastructure: Systems whose incapacitation would have a debilitating impact on national security, economy, or public health.
• Supply Chain Cybersecurity: Protecting an organization's information and systems from risks originating from its suppliers and third-party vendors.
• Zero-Trust Policy: A security model requiring strict identity verification for every person and device trying to access resources on a private network.
• Ransomware: Malicious software designed to block access to a computer system until a sum of money is paid.