Cybersecurity of Critical Infrastructure in India

Context: A reported ransomware attack on third-party data centre Yotta exposed nearly 19,000 files (14.3 GB) linked to the Kudankulam Nuclear Power Plant , highlighting cybersecurity vulnerabilities in India’s critical infrastructure supply chains.

Cybersecurity of Critical Infrastructure in India :

Cybersecurity of strategic national assets extends beyond physical security, firewalls and isolated operational systems. Growing dependence on private contractors and cloud providers exposes sensitive blueprints, technical designs and operational data.

Key Data / Stats on Cybersecurity in India :

Rising Cyber Incidents: CERT-In recorded over 29.44 lakh cyber incidents in 2025, an approximately 85% increase from 15.92 lakh in 2023.

High Sectoral Vulnerability: Indian government and public service organisations reportedly faced over 4,900 cyberattacks weekly, highlighting growing threats to critical services.

Increasing Financial Losses : India’s average data breach cost reached ₹25.5 crore in 2026, rising nearly 16%, driven by complex IT systems and prolonged recovery.

Strategic Data Exposure: The Kudankulam vendor breach reportedly exposed 14.3 GB across 19,000 files (2016–2025), including engineering drawings, inspection reports and contracts.

Recent Incidents in India:

eMudhra Cryptographic Failure: Weak cryptographic keys in eight intermediate CA certificates triggered emergency browser revocations, prompting eMudhra’s withdrawal from the global SSL/TLS certificate

SBI Customer Data Exposure: 3,897 verified SBI customer records surfaced on the dark web within a 3.75-lakh-record dataset, prompting a cybersecurity investigation.

Operation Trident: Authorities busted a multi-state cyberfraud and hawala network, freezing 1,424 mule accounts linked to a ₹100-crore nexus and investigating ₹28,000 crore in transactions.

Kudankulam Vendor Data Breach : A ransomware attack involving Yotta reportedly exposed 14.3 GB of contractor data, highlighting cybersecurity vulnerabilities in strategic infrastructure supply chains.

Existing Framework to Handle Cybersecurity:

National Critical Information Infrastructure Protection Centre (NCIIPC): Designated under Section 70A of the Information Technology Act, 2000 , as the nodal agency to protect Critical Information Infrastructure (CII) whose destruction would impact national security, economy, or public health.

E.g., Formulating cybersecurity guidelines and conducting periodic vulnerability assessments across designated sectors like Power, Nuclear, and Defence.

Computer Emergency Response Team ( CERT-In ): Established under Section 70B of the IT Act, CERT-In serves as the national incident response agency and issued the 2022 Cyber Security Directions mandating 6-hour incident reporting and system log retention.

E.g., Coordinating nationwide responses during ransomware attacks and issuing technical advisories on emerging zero-day vulnerabilities.

Sectoral Computer Security Incident Response Teams (CSIRTs): Specialized sector-level defense wings set up to manage domain-specific cyber risks.

E.g., Operationalization of CSIRT-Power (launched in 2024) and CSIRT-Fin (since 2022) to handle threat monitoring for the national electric grid and banking networks.

Cyber Crisis Management Plan (CCMP): A national framework formulated for government departments and strategic entities to ensure business continuity and rapid recovery during cyber warfare and cyber-terrorism incidents.

E.g., Standardized SOPs enabling critical public utilities to maintain operational continuity during Distributed Denial of Service (DDoS) or ransomware campaigns.

Emerging Threats to Critical Infrastructure:

Third-Party Supply Chain and Vendor Compromise: Attackers target external contractors, suppliers, and commercial cloud providers rather than attempting direct intrusions into air-gapped core networks.

E.g., World Leaks compromising commercial hosting provider Yotta to access Kudankulam engineering drawings held by Reliance Infrastructure.

Advanced Persistent Threats (APTs) & State- Espionage: Sophisticated cyber groups plant sleeper malware within administrative and perimeter networks for long-term reconnaissance.

E.g., The 2019 discovery of Dtrack malware (linked to North Korea’s Lazarus Group) on Kudankulam’s administrative IT systems.

Ransomware-as-a-Service (RaaS) & Double Extortion: Cybercriminal syndicates exfiltrate sensitive commercial and technical files before encrypting local backups, threatening public dark-web leaks if ransoms are not paid.

E.g., Ransomware groups targeting tier-2 engineering vendors and hospital management servers to demand cryptocurrency payments.

Regulatory Gaps in Non-Personal Data Protection: The Digital Personal Data Protection (DPDP) Act focuses on individual personal identifiers, leaving proprietary technical blueprints, engineering schematics, and supply data without clear statutory security mandates once shared outside the operator’s premises.

E.g., Non-nuclear structural schematics and procurement filings falling outside personal privacy legislation and governed only by standard commercial contracts.

Mandate “Security Follows the Data” Architecture: Shift statutory liability from physical plant boundaries to data lifecycles, legally requiring every contractor, sub-contractor, and cloud vendor handling critical data to adhere to NCIIPC-grade security baselines.

Enforce Strict Zero-Trust Architecture (ZTA): Adopt zero-trust network principles across all strategic project integrations, verifying every access request, user identity, and connected endpoint regardless of network location.

Implement Granular Data Classification and Purging: Enforce strict data-minimization protocols so that third-party vendors receive only the technical files essential for their specific work phase, with mandatory data deletion once contracts conclude.

Institutionalize Red-Teaming Across Vendor Ecosystems: Replace routine self-compliance checklists with continuous, independent penetration testing and Red-Team drills across contractors, cloud vendors, and commercial data centers.

Unify the National Critical Infrastructure Security Framework: Establish a consolidated regulatory mechanism linking CERT-In, NCIIPC , and sectoral authorities to audit third-party supply-chain risks, setting pre-defined liabilities before breaches occur.

The Kudankulam data leak serves as a clear reminder that modern critical infrastructure extends well beyond physical security gates and air-gapped reactor cores. Relying solely on internal defenses leaves national assets vulnerable if the broader network of private contractors, cloud providers, and suppliers remains under-protected. Achieving durable cyber resilience requires shifting from facility-based security to data-centric governance, enforcing uniform zero-trust standards across every layer of the critical infrastructure supply chain.

Identify the emerging forms of AI-enabled cyberattacks. Assess the challenges they pose to conventional threat detection and attribution. Bring out the measures required to strengthen India’s cyber defence capabilities.