Ransomware outfit World Leaks has uploaded a vast trove of materials tied to India's biggest nuclear facility onto the dark web, featuring what it claims are facility diagrams along with vendor information drawn from Reliance Group systems.

The Kudankulam Nuclear Power Plant in Tamil Nadu stands as the country's largest atomic site and plays a key role in Prime Minister Narendra Modi's drive to boost national nuclear output.

Reliance Group, linked to businessman Anil Ambani and serving as a contractor at the site, confirmed to Reuters a limited intrusion into data stored on a server run by third-party provider Yotta, noting that officials have been notified.

The company offered no specifics on the exact nature of the exposed material.

Such an incident could create serious safety concerns for the facility, according to Nickolas Roth of the Nuclear Threat Initiative, while also highlighting rising cyber risks for Indian firms often unprepared for sophisticated attacks.

Independent researcher Rakesh Krishnan first flagged nearly 19,000 files amounting to 14.3 gigabytes linked to the search term KKNP that surfaced online from June 11 onward.

Reuters examined the records spanning 2016 through mid-2025 yet could not confirm their validity; alongside diagrams and supplier lists, they reportedly contain meeting notes, inspection logs, equipment assessments and policy documents.

These 19,000 items represented the most sensitive portion of a larger set of 858,000 Reliance files hosted on the World Leaks platform.

Reliance Infrastructure, a group subsidiary, secured a 2018 contract to develop infrastructure for Units 3 and 4 at the plant, both still under construction with a target operational date of 2027 and combined output of 2,000 megawatts.

Ransomware outfit carries history of attacks on Nike and Tata Group

World Leaks, known for prior campaigns against Nike and India's Tata Group, ignored Reuters inquiries about the Reliance incident; the group routinely publishes stolen corporate records after ransom demands go unmet, with its site reachable only via specialized software.

During June the group informed Reuters it had demanded 1.5 million dollars for Tata files holding proprietary designs linked to clients Apple and Tesla before releasing them after the firm failed to respond.

Officials detect unusual server activity during May

The Nuclear Power Corporation of India has been in contact with Reliance regarding the breach, while the national cybersecurity body CERT-In examines the case, per a source aware of developments who spoke on condition of anonymity.

Neither Nuclear Power Corporation Chairman Rajesh Veeraraghavan, CERT-In nor the government's primary press office replied to multiple comment requests.

Yotta reported detecting irregular activity on May 29 involving a Reliance Infrastructure server it manages; the activity was halted promptly and ransomware execution was blocked, though Reliance later notified it in late June of breach claims by outside actors.

Yotta stated it could not confirm the actor's assertions yet shared its technical findings with Reliance Infrastructure and backs the continuing probe.

India's Department of Atomic Energy declined comment, and Modi's office did not reply to Reuters questions.

The posted files do not appear connected to the reactors' primary systems supplied by Russia's Rosatom.

Alleged leaked records feature ventilation and cooling diagrams

The materials include what are described as diagrams for ventilation and cooling setups in Units 3 and 4 plus what seems to be the full layout of a shared control room.

Additional items reportedly encompass vendor bids, approved supplier lists and notes from a 2024 joint inspection meeting between the Nuclear Power Corporation and Reliance that include equipment photos.

One record suggests Reliance Infrastructure and the Nuclear Power Corporation hold an insurance policy covering up to 112 million dollars in the event of terrorism affecting either unit.

Researchers note that in malicious hands the files could theoretically help map support infrastructure, identify vendors and locate gaps in security protocols.

They might reveal to an adversary not only access points but the reach of those systems, Roth added.

India places third globally in data breach volume with 28.9 million accounts affected last year, trailing only the United States and France, per Surfshark data.

A study by the Data Security Council of India and Seqrite last year showed that among 204 surveyed organizations, 73 percent remained unaware of prior attacks while 57 percent lacked basic cyber practices.

This marks the second cyber-related event tied to Kudankulam, following discovery of North Korean-linked malware on its administrative network in 2019; officials at the time said the issue was addressed swiftly with no impact on plant operations.