Cyber threats to nuclear installations are as much a governance problem as a technological one. Comment.

In July 2026, about 19,000 files (14.3 GB) linked to the Kudankulam Nuclear Power Project surfaced on the dark web. They came from a server belonging to an EPC contractor and hosted at a third-party data centre, not from the plant [1]. The attack used technical tools, but it got in through a governance gap.

Technological dimension

• Network intrusion: In 2019, malware hit KKNPP's administrative network. CISAG-DAE and CERT-In investigated, and the government said the plant's control systems had no external connection [2].
• IT vs OT: Air-gapping keeps outsiders from controlling the reactor. However, leaked drawings and supplier lists still help attackers plan reconnaissance, phishing and supply-chain attacks.
• Hardware risk: A 2018 Ministry of Power order requires imported power equipment to be tested in India for hidden malware [5].

Governance dimension

• Perimeter mindset: After 2019, every fix was made inside the plant, such as limits on removable media and blocking harmful websites [2]. The 2026 leak went around all of them through the supply chain [1].
• Legal reach: Sec 70, IT Act covers systems that "directly or indirectly" affect CII. The rules apply only once a system is formally declared "protected" under the 2018 Protected System Rules, which NCIIPC oversees [3]. Contractors' rented servers usually stay undeclared.
• Thin oversight: In 2024-25, NCIIPC carried out only 46 audits in the power and energy sector, against 1,579 by CERT-In [4].
• Fragmented accountability: Nuclear plants fall under DAE, apart from CSIRT-Power [4]. The owner, the contractor and the data centre each hold part of the responsibility.
• Policy lag: The National Cyber Security Policy, 2013 was written before widespread cloud outsourcing [6].
• Stakes: Units 3–6 are still under construction [7], so the leaked data stays useful to attackers for decades.

Way forward

• Write data clauses into EPC contracts: audited hosting, deletion of files once work ends, and immediate breach reporting.
• Use the "indirectly affects" clause to declare contractor repositories protected systems [3].
• Require annual CERT-In-empanelled audits of every vendor that holds plant data, and adopt an updated national cyber security strategy.

In short, technology protects the reactor, while governance protects the network of contractors and vendors around it. As India expands nuclear capacity, it should pair air-gapped engineering with clear contracts, legal coverage and one accountable agency. That would build the resilient infrastructure called for in SDG 9 and keep nuclear energy secure.