India’s nuclear fault line

Safety of civilian nuclear assets traditionally revolves around protecting identifiable physical assets, such as reactors, enrichment facilities, storage sites, command centres and nuclear material.

Cybersecurity was subsequently added as another layer of protection. Now, the digitisation of nuclear enterprises has blurred the distinction between physical security and cyber defence.

The 2026 cyber breach incident of the Indian Kudankulam Nuclear Power Plant (KKNPP) is a prime example of this paradox. Questions go beyond whether a reactor’s operational systems were penetrated, whether ransomware was deployed or whether sensitive files were extracted. Its greater significance lies in what it reveals about the changing boundaries of nuclear security.

The KKNP data breach involved a massive supply chain cyberattack in which the ransomware group, World Leaks, leaked nearly 19,000 sensitive files (totalling 14.3 GB) on the dark web. Hackers compromised a third-party server managed by Yotta Data Services, which hosted data for Reliance Infrastructure, a major engineering contractor building Units 3 and 4 of the plant.

The Nuclear Power Corporation of India Limited (NPCIL) called it a ‘partial breach’, claiming that nuclear safety systems or reactor operations were not compromised. It asserted that leaked files were related to conventional Balance of Plant (BoP) facilities. The Nuclear Threat Initiative, however, believes that the breach could pose a ‘serious’ risk to the plant’s safety. The organisation said such information could allow nefarious actors to understand the plant’s operational support systems, identify suppliers and locate potential weaknesses in the plant’s security chain.

Subsequently, as nuclear infrastructure expands, the digital footprint broadens. The latter increasingly relies on peripheral networks: cloud infrastructure, digital engineering, contractors, interconnected data systems and globally distributed supply chains. The next nuclear fault line may not run through the reactor but through the information ecosystem surrounding it, allowing its architecture, dependencies and vulnerabilities to be reconstructed from the periphery.

The data breach illustrates a new problem digital twins create: the ‘shadow reactor’. Because AI can accelerate organising, comparing and identifying patterns across large datasets, the intelligence problem changes qualitatively. The nefarious actor no longer needs a single comprehensive blueprint of a nuclear facility. Instead, they can assemble seemingly disconnected segments into a coherent picture.

The paradox also points to the growing importance of protecting third-party contractors that often manage sensitive infrastructure data. Information about suppliers can illuminate dependencies; maintenance patterns can reveal operational cycles; personnel information can expose organisational relationships and technical documentation can help explain how different components interact.

A wider purview reveals alarming insights, as this is the second such parameter breach at the KKNPP facility in the last seven years. NPCIL detected a Dtrack malware intrusion in 2019, linked to North Korea’s Lazarus Group. The company maintained that the reactor control systems were protected through separate, isolated networks that were not connected to the internet.

However, air-gapping alone cannot fully protect against cyberattacks. Stuxnet remains a prime example of how air-gapped systems could be breached. More concerningly, the 2019 intrusion reportedly went undetected for more than six months, while the 2026 intrusion went undetected for 2 months.

These incidents come as cyber threats continue to rise in India. The country recorded 28.9 million compromised accounts last year, making it the third-most affected country globally. The breach has yet again exposed a long-standing structural weakness in India’s nuclear governance. The Atomic Energy Regulatory Board remains under the Department of Atomic Energy, the very body it is mandated to regulate. Legislation aimed at establishing an independent regulatory authority has remained stalled since 2011.

This lack of autonomous oversight weakens accountability for nuclear cybersecurity. Likewise, India has had multiple cases of nuclear theft, illicit trafficking and proliferation. It fails to comply with and meet the IAEA Nuclear Security Series and internationally recognised minimum benchmarks for nuclear security.

The implications extend well beyond nuclear safety. Though India’s civil and military nuclear sectors are formally separate, in practice, they are closely interconnected. A breach exposing facility designs, fuel data or supply chain information could put the current safety and security architecture at risk.

Within this context, the strategic stability of South Asia, characterised by limited trust and compressed decision-making timelines, increasingly depends on the security and reliability of the expanding information ecosystem. With both nuclear-armed rivals deeply integrating cyber operations into strategic competition, such vulnerabilities carry regional and international consequences.

Conclusively, a nuclear facility’s cybersecurity is only ever as strong as the weakest contractor in its supply chain. For a plant with dozens of vendors spanning a construction and operational lifecycle that runs across decades, that chain is very long indeed.

This is not an argument against nuclear energy in India or anywhere else. It is an argument that expansion without commensurate investment in material and information security, incident transparency and material accounting is not really expansion. Rather, it is an accumulating risk which the international community must not ignore.

The writer is a research assistant at the Centre for Aerospace and Security Studies (CASS), Lahore. She can be reached at: [email protected]