Beyond Kudankulam’s Fence: A Cybersecurity Challenge

Why in News?

The July 2026 data breach involving the Kudankulam Nuclear Power Project (KKNPP) in Tamil Nadu highlighted a major vulnerability in India’s defence of its Critical Information Infrastructure (CII). 

Over 14 GB of data, including engineering drawings, procurement details, and inspection records, was leaked via a ransomware attack on a third-party commercial data centre (Yotta) housing data for a private contractor (Reliance Infrastructure).

While the Nuclear Power Corporation of India Limited (NPCIL) confirmed that core operational technologies (OT) and nuclear safety systems remained secure due to air-gapping, the incident raises concerns about sensitive information held outside the critical facilities. 

India’s Existing Cybersecurity Framework:

• The National Critical Information Infrastructure Protection Centre, designated under Section 70A of the Information Technology Act, 2000, is the national nodal agency for Protection of Critical Infrastructure. Critical Information Infrastructure (CII) refers to computer resources whose incapacitation or destruction would seriously impair national security, the economy, public health or safety.
• The Indian Computer Emergency Response Team (CERT-In), designated under Section 70B, is the national agency for responding to cybersecurity incidents. Its functions complement NCIIPC’s infrastructure-protection role.
• CERT-In Directions, 2022: The directions cover entities including service providers, intermediaries, data centres, companies and government organisations. They require specified cyber incidents to be reported within six hours of noticing them or being informed of them.
• Protected System Rules, 2018: Formulated to govern declared CIIs, these rules explicitly mandate:
  • Appointment of a dedicated Chief Information Security Officer (CISO).
  • Formalised Information Security Management Systems (ISMS) and routine risk assessments.
  • Formulation of a Cyber Crisis Management Plan (CCMP) and periodic internal/external audits.
  • Mandatory documentation of network architecture, asset inventories, and strict IT security service-level agreements (SLAs).

Existing Challenges: 

• Exposure of Operationally Relevant Information: Drawings, maintenance records and project schedules can reveal dependencies and organisational arrangements. Even documents unrelated to reactor safety may have intelligence value when combined.
• Fragmented Accountability: When data moves from an operator (NPCIL) to an Engineering, Procurement, and Construction (EPC) partner, and down to cloud providers, legal liability dissolves. Operators claim no core networks were breached; contractors point to data centre vulnerabilities; data centres attribute leaks to zero-day malware. This creates a regulatory blind spot where strategic data is leaked on the dark web without a singular entity bearing penal accountability.
• Limits of Personal-Data Protection: The Digital Personal Data Protection Act, 2023 concerns data relating to identifiable individuals. Purely technical drawings or equipment specifications do not become personal data merely because they are sensitive. Consequently, personal-data protection cannot substitute for a comprehensive framework protecting strategic technical information.
• Uneven Security across Vendors: While primary PSUs maintain robust cyber defences, the extended vendor ecosystem remains highly vulnerable. Smaller subcontractors often lack dedicated CISOs, advanced security operations centres (SOCs), or patch management protocols. Attackers leverage these under-defended endpoints as beachheads to pivot into larger enterprise networks. 
• Long-Term Exposure: Stolen information may remain useful after the immediate incident is contained. Restoring a server does not reverse the loss of confidentiality.  
• Targeted Phishing and Impersonation: Supplier names, correspondence and staff details can help attackers create convincing fraudulent communications, impersonate trusted partners or target employees.

Way Forward:

• Data-Centric Security Architecture: Statutory security obligations must follow the data, not the organisation. Security requirements must be legally binding for all contractors, subcontractors, and cloud vendors, complete with strict liability and audit clauses.
• Implement strict data governance policies. Vendors should only access specific data silos necessary for their task, with automated data destruction protocols activated once contracts conclude.
• Transition to Zero-Trust Architecture (ZTA): Move away from the legacy assumption that internal networks are inherently safe. Adopt a strict “never trust, always verify” posture for every endpoint, user, and vendor network accessing project data.
• Continuous Red-Teaming over Annual Compliance: Replace checklist-based annual audits with continuous, proactive adversarial testing (Red-Teaming) across the entire vendor supply chain ecosystem to expose real-time vulnerabilities.
• Institutional Convergence: Establish a unified national framework for supply chain security by bridging the operational architectures of NCIIPC, CERT-In, and sector-specific regulators. This will clearly define legal accountability before an incident occurs. 

India needs consistent safeguards, accountable procurement and coordinated oversight across the supply chain, alongside strong protection of operational systems. Ensuring national security requires that every external node holding strategic information is held to the same strict standards as the core facility itself.

Practice Prelims MCQ: 

Q. Consider the following statements:

1. NCIIPC is the national nodal agency for protecting Critical Information Infrastructure under Section 70A of the IT Act.
2. CERT-In’s cybersecurity directions apply only to government organisations.
3. Zero-trust security avoids granting implicit trust solely on the basis of network location.

Which of the statements given above are correct?

(a) 1 and 2 only
(b) 1 and 3 only
(c) 2 and 3 only
(d) 1, 2 and 3

Answer: (b). CERT-In’s directions also cover specified private entities, including service providers and data centres.

Mains Practice Question: 

Q. “Protection of critical infrastructure requires securing the entire information and vendor ecosystem.” Discuss the cybersecurity risks arising from third-party dependencies and suggest measures to strengthen India’s preparedness.

PDF