BENGALURU, July 15 (Reuters) - Ransomware group World Leaks has posted on the dark web a huge cache of files related to India's largest nuclear plant, including purported blueprints of parts of its facilities and supplier details — information it labelled as coming from Reliance Group. Reuters reviewed the documents, which were dated from 2016 to mid-2025, but could not verify their authenticity. The 19,000 files appeared to be the most sensitive of a total 858,000 Reliance files on the World Leaks website.

In response to reports indicating that a ransomware group had accessed highly sensitive information from a contractor's server related to the Kudankulam Nuclear Project (KNPP), Nuclear Power Corporation of India Ltd. issued a statement on Wednesday, July 15, 2026, dismissing the notion of a "sensitive data breach." Earlier in the day, multiple sources from NPCIL confirmed the data leak but emphasized that the files involved were not related to the safety of the KKNPP plant or nuclear safety.

A data breach has reportedly revealed files linked to India's largest nuclear power plant, according to the Reuters news agency. Ransomware group World Leaks posted on the dark web a huge cache of files related to Kudankulam Nuclear Power Plant, including purported blueprints of parts of its facilities and supplier details – information it labelled as coming from Reliance Group, said Reuters. Nearly 19,000 files totalling 14.3 gigabytes that appear for the search term 'KKNP' – an acronym for the nuclear plant – in the data have been online since June 11, according to independent cybersecurity researcher Rakesh Krishnan, who first alerted Reuters to the leak.

Nuclear Power Corporation of India Ltd., which is leading construction and operation of reactors at the Kudankulam nuclear plant, as well as Anil Ambani's Reliance Group, whose arm Reliance Infra was involved with building infrastructure at two units, Wednesday said its core systems were untouched by a "cyber security incident", after ransomware group World Leaks posted a huge cache of files related to the plant on the dark web and claimed data breach. NPCIL reiterated that "the information claimed to be available in the public domain pertains only to conventional balance of plant common service facilities and does not relate to any nuclear safety or nuclear security-related systems or information".

The Nuclear Power Corporation of India Limited (NPCIL) on Wednesday denied reports of a "sensitive data breach" at the Kudankulam Nuclear Power Project, asserting that no sensitive nuclear information or critical systems had been compromised after a ransomware group claimed to have leaked thousands of project-related files on the dark web. The clarification came after Reuters reported that the ransomware group World Leaks had published more than 19,000 files linked to the Tamil Nadu-based nuclear plant, including engineering blueprints, vendor lists, inspection records and operational documents allegedly sourced from a server belonging to project contractor Reliance Infrastructure. NPCIL said the information in question related only to the Balance of Plant (BoP) package, common service facilities of a conventional nature that are not part of the plant's nuclear safety or nuclear security systems.

The article states that data related to the Kudankulam nuclear power plant was leaked online by the hacking group World Leaks, and that among 858,000 Reliance files, 19,000 secret files were identified as belonging to Kudankulam. It adds that Reliance said the breach occurred at the third-party Yotta data centre.

On Tuesday, July 15, 2026, news emerged regarding a significant data breach involving the Kudankulam Nuclear Power Plant, where several gigabytes of sensitive information were reportedly compromised and leaked following a ransomware attack. The leaked data has surfaced on World Leaks, a dark web platform operated by cybercriminals who target susceptible organizations with ransomware, threatening to disclose the information unless a ransom is paid.

According to a report by Reuters, a ransomware group called World Leaks has claimed to have leaked thousands of files linked to India's largest nuclear power plant, including alleged blueprints, supplier details, and project documents. Independent cybersecurity researcher Rakesh Menon said the breach includes nearly 19,000 files totaling 14.3 gigabytes that appear for the search term KKNPP, an acronym for the nuclear power plant; the 19,000 files appear to be the most sensitive of a total 858,000 Reliance Infra files on the World Leaks website. NPCIL stated that the material in the public domain relates only to conventional balance of plant common service facilities and does not involve any nuclear safety or nuclear security systems.

The article says thousands of confidential documents related to the infrastructure and suppliers of Tamil Nadu’s Kudankulam nuclear plant were leaked on the dark web, and that 19,000 files were identified from a larger set of 858,000 Reliance files. It reports that the hackers claimed the data came from Anil Ambani’s Reliance Group, a contractor at the plant.

The video report states that files related to the Kudankulam Nuclear Power Plant (KNPP) in Tamil Nadu have been exposed in a significant data breach. It explains that thousands of documents were uploaded, with the claim that these documents were stolen from servers of Anil Ambani’s Reliance Group and include important information related to the Kudankulam nuclear project. The report further notes that about 8.58 lakh (858,000) files of the group were uploaded, of which approximately 19,000 files are said to be linked specifically to the Kudankulam nuclear plant, including meeting records, insurance documents, technical proposals and other project-related files.

NDTV reported that World Leaks had posted files linked to the Kudankulam Nuclear Power Plant on the dark web, including purported blueprints of parts of the plant, supplier details, inspection records and equipment reviews. The report also said a senior atomic scientist described the incident as unrelated to nuclear security.

The article says 19,000 important files, including control-room drawings and ventilation structure documents, were reported as leaked on the dark web, and that the Central government’s CERT-In agency was conducting an intensive investigation. It also says the files were allegedly stolen from Reliance’s server used for construction work.

Experts from Group-IB, who discovered and analysed an archive containing dtrack, a remote-administration tool attributed to North Korean group Lazarus, said that analysis revealed that the logs contained data from a compromised machine running Windows that belonged to an employee of the Nuclear Power Corporation of India Limited (NPCIL). The report says the archive's main file with the compromised data is dated January 30, 2019, more than six months before they were detected.

The post describes a "data breach at Kundankulam plant" and says that "the leak allegedly includes blueprints and supplier details." It refers to a segment where WION journalists provide more details, indicating that the exposed materials are project-related files tied to the Kudankulam nuclear facility and its contractors. The wording suggests that confidential technical and vendor information connected to the plant has been published online following the breach.

The article reports that the World Leaks hacker group published about 19,000 confidential files tied to Kudankulam on the website “World Leaks,” and that the leaked set was part of 858,000 Reliance files. It says NPCIL issued a clarification about the alleged data leak.

This WION Dispatch post states: "India probes nuclear plant 'data breach' The leak allegedly includes blueprints and supplier details." The accompanying description notes that the incident involves data linked to the Kudankulam Nuclear Power Plant and references alleged blueprints and supplier information that have reportedly been exposed as part of the breach, prompting an official probe.

NPCIL confirmed that a malware had indeed infected its system at the Kudankulam Nuclear Power Plant (KKNPP), a day after KKNPP officials had categorically asserted that the systems at the plant could not be accessed by anyone outside the network as they were all isolated. 'Investigation also confirms that the plant systems are not affected,' he asserted. The cyberintrusion came to light after a data dump pointed to a 'dtrack' malware, which can be used as a remote administrator tool, having infected systems at the KKNPP.

The article says World Leaks posted documents related to Kudankulam on the dark web and that the files included infrastructure details and supplier information. It also reports a claim that this was India’s largest nuclear power plant.

The document discusses a prior cyber incident at the Kudankulam Nuclear Power Plant involving malware later identified as "Dtrack". It notes that a threat actor breached master domain controllers at the Kudankulam plant and at ISRO with this malware, and that NPCIL was alerted on September 4. Initially, KNPP officials denied having suffered any malware infection, but within 24 hours NPCIL admitted to the security breach, stating: "Identification of malware in NPCIL system is correct." The paper reports that the attack was attributed to the North Korean threat actor Lazarus and that a large amount of data was stolen during the breach, with VirusTotal classifying the malware as part of the DTrack family.

The article says nearly 19,000 files related to Kudankulam were posted by the World Leaks group and that the incident is the second reported cyber-security issue involving the plant. It also notes that the outlet quoted a senior nuclear scientist saying the leak had no connection to nuclear safety.

The article says World Leaks published roughly 19,000 files linked to Kudankulam, that they were described as documents and supplier details, and that Reliance said it experienced a partial data breach at Yotta, a third-party data service provider. It frames the incident as a national-security concern.

The Nuclear Power Corporation of India Limited (NPCIL), which operates the Kudankulam Nuclear Power Plant, has categorically stated that there has been no impact on core nuclear systems due to the reported data breach on dark web. The organisation highlighted that the plant operates on an air-gapped system, ensuring that core operational infrastructure is not connected to the internet, significantly reducing risks of cyber intrusion.

NPCIL is the public sector company responsible for the operation of nuclear power plants in India, including the Kudankulam Nuclear Power Plant, which is frequently described in media as India’s largest nuclear power plant by capacity. Public communications after the 2026 incident emphasized that any leaked files were linked to conventional balance-of-plant facilities and contractor systems rather than core nuclear safety or security systems, underscoring that the exposure arose from a contractor’s server rather than the plant’s internal nuclear control networks.

BBC Tamil reported then that claims of a cyberattack on Kudankulam were false and that the plant said its computers were not connected to the internet. This is a separate earlier allegation, but it is relevant as background showing previous public disputes over cyber claims involving the plant.