NPCIL responds to Kudankulam data leak reports, rules out nuclear safety impact

State-run Nuclear Power Corporation of India Ltd (NPCIL) on Wednesday said that drawings and data reportedly leaked following a cyber breach at Reliance Infrastructure pertain only to conventional facilities at the Kudankulam Nuclear Power Project (KKNPP) and have no connection with nuclear safety or security systems.

The clarification came after media reports said ransomware group World Leaks had posted thousands of files on the dark web, purportedly linked to KKNPP Units 3 and 4, including alleged engineering drawings and supplier-related documents obtained through a breach at Reliance Infrastructure.

The engineering, procurement and construction (EPC) contract for the Common Services-Balance of Plant (BOP) package at Kudankulam Units 3 and 4 was awarded to Reliance Infrastructure in 2018 through a public tender process.

NPCIL said the contract covers engineering, procurement, construction and commissioning of common service facilities, which are "of conventional nature" and are typically found in thermal power plants and other process industries.

"They are not related to nuclear safety or nuclear security systems," NPCIL said.

The corporation said that as part of the public tendering process, it had provided indicative drawings and technical specifications to bidders.

Based on these inputs and project requirements, Reliance Infrastructure prepared detailed engineering drawings in consultation with the original equipment manufacturers (OEMs), which were reviewed and accepted by NPCIL after ensuring compliance with technical specifications.

"NPCIL reiterates that the information claimed to be available in the public domain pertains only to conventional Balance of Plant (BOP) common service facilities and does not relate to any nuclear safety or nuclear security-related systems or information," it said.

According to a Reuters report, ransomware group World Leaks has uploaded nearly 19,000 files, allegedly related to Kudankulam Units 3 and 4.

The files reportedly include purported blueprints of ventilation and cooling systems, supplier details, inspection records and insurance documents.

Reliance Group had told Reuters that there was a "partial breach" of its data on a server hosted by third-party data centre service provider Yotta and that the government had been informed.

The company, however, did not disclose what specific data had been compromised, the report said..

Yotta has said it detected suspicious activity on a Reliance Infrastructure server in May, terminated it immediately and is supporting the ongoing investigation.