UPSC Mains
GS Paper III
Internal Security
Kudankulam Data Breach Exposes Supply-Chain Risks in Critical Infrastructure
A data breach linked to the Kudankulam nuclear power project was reported on 15 July 2026. It shows that critical infrastructure data can leak through contractors and data centres
EXPANSION TARGET
6,000 MW
REACTOR TYPE
VVER-1000 PWRs
CII NODAL AGENCY
NCIIPC (Section 70A)
📰
Why in News
A data breach linked to the Kudankulam nuclear power project was reported on 15 July 2026. It shows that critical infrastructure data can leak through contractors and data centres.
ℹ️
About the Kudankulam Nuclear Power Plant
- Location: Tirunelveli district, Tamil Nadu.
- Scale: India’s largest nuclear power station by installed capacity, being expanded to 6,000 MW.
- Operator: The Nuclear Power Corporation of India Limited (NPCIL), under the Department of Atomic Energy.
- Technology: Russian-designed VVER-1000 Pressurised Water Reactors (PWRs), built under India–Russia cooperation.
📖
About the Legal Framework
- Section 70, IT Act, 2000: It allows the declaration of a protected system.
- Section 70A: It provides for the NCIIPC, the nodal agency for Critical Information Infrastructure (CII), under the NTRO.
- Section 70B: It provides for CERT-In, whose 2022 directions make incident reporting mandatory.
- DPDP Act: It does not generally cover engineering data that has no personal information.
⭐
Why does it matter?
The risk lies in the supply chain, not the reactor.
- Contract-based protection: Once data leaves the operator, its protection depends mostly on contracts.
- Accountability gap: The operator, contractor and host can each say they were not at fault, yet documents still reach the dark web.
- Strategic value: Drawings and supplier lists help attackers plan phishing and find the weakest link.
- Repeat pattern: The 2019 Dtrack attack also hit the periphery, not the core.
🛤️
Way Forward
Duties that follow data
Bind contractors and cloud providers to set standards, with liability and audit terms in contracts.
Data classification
Let a contractor hold only the data it needs, for only as long as needed.
Third-party audits
Run third-party risk checks and red-team exercises across the vendor chain.
One national framework
CERT-In, NCIIPC and regulators should agree on one supply-chain security framework, with a zero-trust approach for projects of national importance.
Conclusion: Critical infrastructure is only as secure as the weakest firm that holds its data. Clear and uniform rules that make every holder of such data responsible are needed.
📰
Source: The Hindu
