World Leaks publishes Kudankulam nuclear plant files from a Reliance Group data breach

On or around 15 July 2026, Indian media reported that the data-extortion group World Leaks had published a large cache of files relating to India's Kudankulam Nuclear Power Plant (KKNP) — the country's largest nuclear generating station, in Tamil Nadu — on its dark-web leak site. The roughly 19,000 files, totalling about 14.3 GB, had reportedly been online since 11 June 2026 and formed part of a far larger trove — some 858,000 files — that the group attributed to Reliance Group. Reliance Group acknowledged a "partial breach" of its data and said the Indian government had been informed.

The exposed documents did not come from the plant operator's own network but from a Reliance server hosted at a third-party data centre run by Yotta. According to Yotta, it detected and terminated suspicious activity on 29 May 2026 on a server it hosts for Reliance Infrastructure, saying it prevented a suspected ransomware execution; Reliance Infrastructure later informed Yotta, at the end of June, that external threat actors had claimed a data breach. The episode underscored how a contractor's exposure at a shared hosting provider can put sensitive material about critical national infrastructure into criminal hands.

What was in the leak

Reviews of the KKNP-tagged files described purported blueprints for ventilation and cooling systems used in the plant's Units 3 and 4, as well as what appeared to be the complete floor layout of a "common control room." The cache also reportedly contained vendor proposals, a list of approved suppliers, and a record of a 2024 meeting on a joint inspection by the Nuclear Power Corporation of India (NPCIL) and Reliance, complete with photographs of equipment. The files appeared to be engineering, procurement and project-management records tied to Reliance's contractor role rather than operational reactor data.

Official response and reactor safety

The Nuclear Power Corporation of India (NPCIL), which operates the country's nuclear plants, said the breach did not reveal any sensitive information related to nuclear security, and reporting noted that the leaked documents did not appear to relate to the reactors' core systems, which are supplied by Russia's state-owned Rosatom. India's national computer-emergency team, CERT-In, opened an investigation, and NPCIL said it was in communication with Reliance. Because the intrusion was attributed to a third-party hosting environment, the leaked material was already public, and the full scope of what was taken had not been independently established at the time of reporting, the incident's status remained unknown.