Securing India’s Critical Infrastructure Against Cyber Threats

Context

The reported ransomware attack involving third-party data centre Yotta, which allegedly exposed nearly 19,000 files amounting to 14.3 GB of data associated with the Kudankulam Nuclear Power Plant, has highlighted weaknesses in the cybersecurity of India’s critical infrastructure supply chains.

Cybersecurity of Critical Infrastructure in India

Cybersecurity is no longer limited to protecting physical facilities, internal networks and operational technology. As strategic organisations increasingly depend on private contractors, cloud platforms and external service providers, sensitive engineering documents and technical information may remain vulnerable even outside the core infrastructure.

Cybersecurity Landscape in India: Key Data

• Rising cyber incidents: CERT-In recorded more than 29.44 lakh cybersecurity incidents in 2025, compared with 15.92 lakh in 2023.
• Vulnerable public services: Government and public service organisations reportedly encountered over 4,900 cyberattacks per week, raising concerns about the continuity of essential services.
• Increasing breach costs: The average cost of a data breach in India reportedly reached ₹25.5 crore in 2026, reflecting the financial and operational burden of cybersecurity failures.
• Exposure of strategic information: The reported Kudankulam-related incident involved approximately 19,000 files containing 14.3 GB of data, including engineering drawings, inspection records and contractual documents.

Recent Cybersecurity Incidents in India

• eMudhra certificate concerns: Weak cryptographic keys in eight intermediate Certificate Authority certificates reportedly led to emergency browser revocations and the withdrawal of eMudhra’s certificates from the global SSL/TLS ecosystem.
• SBI customer data exposure: A dataset containing 3.75 lakh records reportedly included 3,897 verified SBI customer records that surfaced on the dark web, prompting an investigation.
• Operation Trident: Authorities uncovered a multi-state cyberfraud and hawala network, freezing 1,424 mule accounts linked to an alleged ₹100-crore nexus and investigating transactions worth ₹28,000 crore.
• Kudankulam vendor breach: The reported ransomware incident demonstrated how vulnerabilities in external service providers can potentially expose information associated with strategically important infrastructure.

Existing Cybersecurity Framework in India

1. National Critical Information Infrastructure Protection Centre (NCIIPC)

• Established under Section 70A of the Information Technology Act, 2000, NCIIPC is the nodal agency for protecting Critical Information Infrastructure (CII).
• It focuses on systems whose disruption or destruction could adversely affect national security, the economy, public health or safety.
• Its functions include issuing security guidelines and supporting vulnerability assessments in critical sectors such as power, nuclear energy and defence.

2. Indian Computer Emergency Response Team (CERT-In)

• Established under Section 70B of the IT Act, CERT-In coordinates responses to cybersecurity incidents across India.
• Its 2022 Cyber Security Directions require specified entities to report listed cyber incidents within six hours of noticing them or being informed of them and to maintain ICT system logs for the prescribed period.

3. Sectoral Computer Security Incident Response Teams (CSIRTs)

• Sector-specific response teams address cybersecurity risks in specialised domains.
• CSIRT-Power and CSIRT-Fin support cybersecurity preparedness and incident response in the electricity and financial sectors, respectively.

4. Cyber Crisis Management Plan (CCMP)

• The CCMP provides a framework for government departments and strategic organisations to prepare for and respond to major cyber incidents.
• It supports coordinated response, disaster recovery and continuity of essential services during ransomware attacks, distributed denial-of-service incidents and other cyber emergencies.

Emerging Threats to Critical Infrastructure

1. Third-Party and Supply-Chain Vulnerabilities

Cybercriminals may target contractors, cloud providers and commercial data centres rather than attempting to penetrate highly protected core systems directly. Weak vendor security can expose sensitive information beyond the physical boundaries of a critical facility.

2. Advanced Persistent Threats (APTs)

State-linked or highly sophisticated groups may establish a prolonged presence in administrative networks to collect intelligence, monitor activities and identify pathways towards sensitive systems. The discovery of Dtrack malware on Kudankulam’s administrative IT systems in 2019 highlighted these concerns.

3. Ransomware-as-a-Service and Double Extortion

Attackers may steal confidential information before encrypting systems or backups. They can then threaten to publish the stolen material unless a ransom is paid, creating risks even when operational systems remain functional.

4. Gaps in the Protection of Non-Personal Data

The Digital Personal Data Protection Act, 2023, primarily addresses digital personal data. Proprietary engineering drawings, industrial designs and technical documentation also require robust protection, but their security cannot be assumed to be adequately covered by personal-data legislation or ordinary commercial contracts alone.

5. Increasing Interdependence of Digital and Physical Systems

Modern infrastructure relies on interconnected information technology (IT), operational technology (OT), industrial control systems and external digital services. A compromise of administrative systems or vendor networks can create risks for the confidentiality, integrity and availability of essential services.

Way Forward

1. Adopt a “Security Follows the Data” Approach

Cybersecurity obligations should extend beyond the premises of critical facilities. Contractors, subcontractors and cloud providers handling sensitive information should comply with security standards proportionate to the criticality of the data they process.

2. Implement Zero-Trust Architecture

Every user, device and access request should be authenticated and authorised continuously, regardless of its location within or outside an organisation’s network. Privileged access should be restricted, monitored and periodically reviewed.

3. Strengthen Data Classification and Minimisation

• Classify information according to sensitivity and national security implications.
• Share only the minimum technical information necessary for a contractor’s assigned task.
• Enforce secure deletion, access revocation and data-return requirements when contracts end.
• Maintain auditable records of data transfers and third-party access.

4. Conduct Independent Security Audits and Red-Team Exercises

Critical infrastructure operators should conduct regular penetration tests and simulated cyberattacks across their vendor ecosystems. Independent assessments can reveal weaknesses that routine compliance checklists may overlook.

5. Establish Clear Accountability for Third-Party Breaches

Contracts and regulatory standards should define vendor responsibilities, incident-reporting timelines, liability and recovery obligations. Critical suppliers should undergo risk assessments before onboarding and throughout the contractual relationship.

6. Improve Coordination Among Cybersecurity Agencies

CERT-In, NCIIPC, sectoral regulators and infrastructure operators should strengthen information-sharing mechanisms, joint exercises and coordinated incident response. A common framework for supply-chain risk assessment can reduce inconsistencies across sectors.

7. Strengthen Recovery and Resilience

Organisations should maintain tested offline backups, secure recovery environments, incident-response teams and continuity plans. Regular exercises should assess whether essential services can be restored without relying on compromised networks or vendors.

Conclusion

The reported Kudankulam-related data exposure underscores that protecting strategic infrastructure requires more than securing the physical facility or its internal networks. Private contractors, cloud platforms and external suppliers form part of the wider security ecosystem. A shift towards data-centric protection, zero-trust access, enforceable vendor accountability and coordinated incident response is essential to strengthen India’s cyber resilience and safeguard national security.

Source : The Hindu