NPCIL denies 'sensitive data breach' at Kudankulam nuclear plant project

📌 Summary:

• Reports claimed a ransomware group accessed highly sensitive files of the Kudankulam Nuclear Power Project (KKNPP) from a contractor's server
• On July 15, 2026 the Nuclear Power Corporation of India Limited (NPCIL) denied a "sensitive data breach", saying the leaked information relates only to "conventional balance of plant common service facilities" — not the reactor or safety-critical systems
• NPCIL clarified that the Engineering, Procurement and Construction (EPC) contract for the common services / Balance of Plant package was awarded to Reliance Infrastructure Ltd through a public tender
• Significance: highlights third-party/contractor cyber-supply-chain risk to critical infrastructure, even when core reactor systems are air-gapped; echoes the 2019 KKNPP malware incident

🎯 UPSC Relevance: GS3 — cyber security of critical infrastructure, protection of nuclear installations, third-party/vendor risk and CII resilience

📝 Prelims Facts:

• NPCIL is a PSU under the Department of Atomic Energy that operates India's nuclear power plants
• Kudankulam (KKNPP) is in Tamil Nadu, built with Russian (Rosatom) cooperation using VVER reactors
• "Balance of Plant" refers to the non-nuclear supporting systems of a power plant (not the reactor island)

🔑 Key Term: Critical Information Infrastructure (CII) — computer resources whose incapacitation would debilitate national security, economy or public health; protected under the IT Act and NCIIPC