Beyond Kudankulam’s fence, a cybersecurity challenge

UPSC Syllabus: Gs Paper 3- Infrastructure and Cyber security

Introduction

India’s critical infrastructure increasingly depends on contractors, suppliers and data centres, extending cybersecurity risks beyond facility boundaries. In July 2026, ransomware group World Leaks claimed to have leaked nearly 19,000 files totalling 14.3 GB linked to Kudankulam. Reliance Infrastructure confirmed a breach involving data hosted by Yotta. NPCIL said the material concerned non-nuclear infrastructure, and no compromise of reactor controls or nuclear safety systems was publicly established.

Changing Nature of Critical Infrastructure Security

1.Expanding Security Perimeter: Critical infrastructure increasingly depends on interconnected contractors, suppliers, cloud platforms and service providers that hold sensitive project information, extending cybersecurity risks beyond operators’ direct safeguards.

2. Growing Private Sector Dependence: Infrastructure development increasingly involves private engineering firms, technology partners and commercial data centres, making their cybersecurity practices essential for national infrastructure protection.
3. 3. Shift in Attack Strategies: Attackers may target less-protected vendors instead of heavily secured facilities, exploiting legitimate access, shared credentials and interconnected systems to compromise information.
4. Information as Strategic Intelligence: Documents unrelated to reactor controls may collectively reveal infrastructure layouts, equipment configurations, maintenance dependencies, suppliers and potential access points.
5. Earlier Warning at Kudankulam: In 2019, Dtrack malware was detected on a computer connected to the plant’s Internet-facing administrative network, while NPCIL stated that critical internal networks remained unaffected.

Challenges in Critical Infrastructure Cybersecurity

1. Third-Party and Digital Vulnerabilities: Weak vendor security, compromised credentials, phishing, insecure remote access, inadequate identity management and vulnerable cloud infrastructure can expose sensitive project information.
2. Ransomware and Double Extortion: Attackers may steal valuable information and threaten public disclosure while demanding ransom, making data confidentiality as important as preventing operational disruption.
3. Information Aggregation Risk: Individually routine documents can collectively reveal infrastructure layouts, suppliers, personnel and technical dependencies, enabling targeted reconnaissance, phishing and potential future attacks.
4. Limited Visibility Across Supply Chains: Infrastructure operators may lack sufficient visibility into contractors, subcontractors and hosting providers, making it difficult to assess risks throughout interconnected digital ecosystems.
5. Fragmented Accountability: Operators, contractors and hosting providers may shift responsibility after a breach, leaving sensitive information exposed despite individual organisations claiming compliance.
6. Uncertainty in Incident Assessment: Exaggerated ransomware claims and limited visibility into compromised systems can complicate the verification of stolen data, affected systems and potential security implications.

Strategic and National Security Implications

1. Espionage Risks: Leaked engineering drawings, procurement records and supplier information can help hostile actors understand infrastructure arrangements and identify valuable targets for intelligence gathering.
2. Potential Sabotage: Information about equipment configurations, maintenance dependencies and access arrangements may assist future sabotage attempts, although document leakage alone does not establish operational access.
3. Targeted Social Engineering: Supplier records, organisational charts and personnel details can help attackers design convincing phishing campaigns against contractors and infrastructure employees.
4. Economic Security: Cyberattacks against interconnected infrastructure can threaten economic stability by disrupting essential services, business operations and public service delivery.
5. Cascading Infrastructure Risks: Compromise of interconnected digital systems may affect multiple sectors, including electricity, telecommunications, banking and transportation, amplifying the consequences of cyber incidents.
6. Public and Institutional Trust: Weak cybersecurity governance can undermine public confidence, corporate credibility and investor confidence in institutions responsible for protecting critical infrastructure.
7. Strategic Sovereignty: Dependence on commercial digital infrastructure and global technology supply chains makes cybersecurity essential for national security, economic resilience and strategic autonomy.

India’s Cybersecurity Governance and Legal Framework

1. CERT-In’s Role: The Indian Computer Emergency Response Team handles cybersecurity incident response, while its 2022 directions require specified cyber incidents to be reported within six hours of noticing them or being brought to notice.
2. NCIIPC’s Responsibility: The National Critical Information Infrastructure Protection Centre, established under Section 70A of the IT Act, is responsible for protecting critical information infrastructure.
3. Data Protection Framework: The Digital Personal Data Protection Act, 2023 primarily concerns digital personal data; technical documents without personal data generally fall outside its scope.
4. Applicable Legal Provisions: Depending on the facts, Sections 43 and 66 of the IT Act may apply to unauthorised access and computer-related offences, while Section 66F requires specific elements of cyber terrorism; other laws may apply where their conditions are met.
5. Corporate Governance Obligations: Listed entities must disclose details of cybersecurity incidents or breaches, or loss of data or documents, with their quarterly corporate governance reports, as specified under Regulation 27(2)(ba) of SEBI’s LODR (Listing Obligations and Disclosure Requirements) Regulations.

Way Forward

1. Uniform Security Standards: Extend defined cybersecurity standards, oversight and accountability to contractors, subcontractors and data centres handling critical infrastructure information.
2. Clear Legal Accountability: Establish clear responsibilities for protecting sensitive information across the supply chain, including when data is stored or processed outside the operator’s systems.
3. Strengthen Contractual Safeguards: Include cybersecurity standards, audit rights, liability clauses, breach notification requirements, encryption and incident-response protocols in vendor contracts.
4. Adopt Risk-Based Assessments: Replace annual certifications with regular third-party risk assessments, supply-chain audits and red-team exercises to identify vulnerabilities.
5. Implement Zero Trust Security: Verify every access request, enforce multi-factor authentication, strengthen privileged access management and monitor vendor access continuously.
6. Strengthen Technical Defences: Improve network segmentation, endpoint detection, security monitoring and secure remote access to limit unauthorised access and lateral movement.
7. Ensure Need-Based Data Sharing: Classify sensitive project information and share only essential data for a limited duration, reducing exposure and potential misuse.
8. Improve Institutional Coordination: Establish a unified national supply-chain cybersecurity framework involving CERT-In, NCIIPC, sectoral regulators and infrastructure operators, with clearly assigned responsibilities for incident response.

Conclusion

The Kudankulam incident underscores that critical infrastructure security extends beyond facility boundaries. India needs enforceable supply-chain standards, clear accountability, risk-based vendor assessments and coordinated incident response. Protecting sensitive information across contractors and service providers is essential to strengthen cyber resilience, preserve public trust and safeguard national security as infrastructure becomes increasingly interconnected.

Question for practice:

Discuss the cybersecurity challenges associated with protecting India’s critical infrastructure and suggest measures to strengthen supply-chain cyber resilience.

Source: The Hindu; Times of India