Kudankulam Blueprints Exposed Online: How Safe Is India's Biggest Nuclear Power Plant?

India's largest nuclear plant just had a very uncomfortable secret dragged into daylight. A ransomware group called World Leaks dumped nearly 19,000 files tied to the Kudankulam Nuclear Power Plant onto the dark web, part of a massive 858,000 file haul allegedly stolen from Reliance Infrastructure , the Anil Ambani led contractor building Kudankulam's Unit 3 and Unit 4. Buried among blueprints and supplier lists sits one document that should worry every Indian, a policy insuring Reliance and the Nuclear Power Corporation for 112 million dollars specifically in the event of a terrorist attack on the plant.

Why does that document exist at all? Why would the operators of a nuclear facility quietly price in the odds of a terror strike rather than simply insisting the plant is secure? That single question turns a routine cyberattack story into something far more unsettling, an admission, on paper, that the people running Kudankulam treat a terror attack as a real, budgeted possibility, not a remote hypothetical.

The rest of the leak reads like a blueprint for exactly that scenario. Floor layouts of a shared control room. Ventilation and cooling system designs for the plant's newest units. A list of approved suppliers. Photos from a 2024 inspection. None of it touches the reactor core, which runs on Russian Rosatom technology and sits on a separate network, but experts say that almost doesn't matter. Nickolas Roth of the Nuclear Threat Initiative put it plainly, this kind of data shows an adversary not just who has access to the project but which systems that access reaches.

So who is actually protecting this information? Yotta , the data centre hosting Reliance's servers, says it caught suspicious activity in May and stopped an active ransomware attempt, only for Reliance to admit weeks later that attackers still claimed to have stolen data anyway. And where is the government in all this? CERT In is reportedly investigating, yet the Department of Atomic Energy, the Nuclear Power Corporation chairman and the Prime Minister's office all stayed silent when asked to comment.

This is also not Kudankulam's first brush with hackers, a North Korean linked malware infection hit its administrative network back in 2019. The question now is simple, if it happened twice, what guarantees it will not happen again?

Despite the sensitivity, virtually every official body, the Department of Atomic Energy, the Nuclear Power Corporation chairman, CERT In, even the Prime Minister's office, either declined to comment or didn't respond at all.