India's Nuclear Operator Denies Safety Risks in Data Breach Incident
The Nuclear Power Corporation of India (NPCIL), which operates the Kudankulam Nuclear Power Plant, has clarified that a recent data breach did not expose any nuclear safety or security information. The breach was reported after the ransomware group World Leaks posted a significant amount of data on the dark web, including nearly 19,000 files totaling 14.3 gigabytes. According to NPCIL, the leaked documents pertain to common service facilities rather than the plant itself, which is located in Tamil Nadu and is being developed in partnership with Russia's Rosatom. Currently, two of the planned six pressurized water reactors are operational, each with a capacity of 1,000 MW.
NPCIL emphasized that the information made public does not relate to any nuclear safety or security systems, describing the facilities involved as conventional and typical of thermal power plants and other industrial processes. The breach reportedly originated from the Reliance Group, which was contracted in 2018 to construct systems for the plant, excluding the nuclear components. The Reliance Group acknowledged a partial data breach on a server managed by Yotta, a third-party data center service provider, and confirmed that the government had been notified.
Yotta stated that it had thwarted a ransomware attack on May 29. Despite NPCIL's reassurances, experts like Nickolas Roth from the Nuclear Threat Initiative have expressed concerns about the potential risks posed by the breach, although the authenticity of the leaked documents remains unverified. The dark web, where the data was posted, is a part of the internet that requires specialized browsers to access and is often used by hackers to release stolen corporate data after ransom demands are ignored. In a similar incident, World Leaks previously published confidential designs from Tata Group after the company declined to pay a ransom of $1.5 million. This incident follows a previous cybersecurity issue at the Kudankulam plant in 2019, when malware linked to a North Korean hacking group was detected on its administrative network.
