"The perimeter of critical infrastructure security now lies in the supply chain." Discuss with reference to the 2026 Kudankulam data breach.

In July 2026, the ransomware group World Leaks posted about 19,000 files (14.3 GB) linked to the Kudankulam Nuclear Power Project (KKNPP) on the dark web. The files did not come from the plant. They came from a contractor's server hosted in a third-party data centre [1]. The case shows that the security perimeter now runs through the supply chain, not around the plant.

How the supply chain became the perimeter

• Contractor as entry point: Reliance Infrastructure, the EPC contractor for Units 3 and 4, confirmed a "partial breach" on a server hosted by Yotta [1].
• Useful material for attackers: The documents run from 2016 to mid-2025 and include blueprints and a control-room layout [1]. Attackers can use them to plan targeting and social engineering.
• Two different doors: The 2019 malware attack came in through KKNPP's own administrative network. Every fix after it was made inside the plant, such as limits on removable media and blocking of harmful websites [2].

Why the current framework falls short

• Legal reach: NCIIPC (Sec 70A, IT Act) checks compliance with the 2018 Protected System Rules, but only for declared protected systems [3]. A rented server holding a contractor's files is unlikely to have been declared.
• Audit gap: In FY 2024-25, NCIIPC carried out only 46 audits across the whole power and energy sector, against 1,579 by CERT-In [4].
• Split oversight: CSIRT-Power (2023) covers the power sector [4]. Nuclear plants come under DAE's own cyber team (CISAG) [2]. No single agency watches the owner, the contractor and the data host together.

The counter-view

• No reactor control was reached. NPCIL said the data related only to common service facilities [1]. Control systems that are physically cut off from outside networks (air-gapped) still protect the reactor.
• Even so, recent design data and supplier lists help attackers plan future attacks on weaker vendors.

Way forward

• Data clauses in EPC contracts: audited hosting only, deletion of files after the work is done, and immediate breach reporting to DAE.
• Use Sec 70 more widely to declare contractor repositories of nuclear design data as protected systems [3].
• Extend the power-sector model: the Ministry of Power already requires imported equipment to be tested in India for malware [5]. The same supply-chain control should apply to data going out to contractors.
• Update the 2013 National Cyber Security Policy for an era of outsourcing and cloud hosting [6].

Kudankulam shows that a strong fence cannot protect data that has already left the plant. Contract-level accountability, wider audits and one agency watching the whole supply chain can secure India's nuclear expansion. That protects both energy security and public trust.