Loading story…
The cyber extortion group World Leaks published a cache of files allegedly tied to India’s Kudankulam Nuclear Power Plant after claiming it breached the internal network of contractor Reliance Group. Reporting says roughly 19,000 files totaling about 14.3 GB, labeled KKNP, were exposed as part of a much larger dump of about 858,000 Reliance-linked files. The leaked material reportedly includes blueprints, supplier details, inspection records, equipment reviews, insurance documents, and project documentation connected to Kudankulam Units 3 and 4, with some documents reviewed by Reuters dated from 2016 to mid-2025, though authenticity has not been independently verified.
NPCIL denied that nuclear safety or security systems were compromised, saying the exposed data concerned only conventional balance-of-plant service facilities already covered under a public tender. Reliance acknowledged a partial breach involving a server hosted by Yotta and said Indian government authorities and law enforcement were notified, while Yotta said it detected suspicious activity on May 29 and blocked suspected ransomware execution but could not confirm subsequent breach claims. Despite the denial of impact to sensitive nuclear systems, outside researchers and experts warned that the leaked blueprints, supplier information, and related records could still create security risks for critical infrastructure.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
India's Computer Emergency Response Team (CERT-In) opened an investigation into the exposure of Kudankulam Nuclear Power Plant-related files that were leaked by World Leaks and tied to Reliance Infrastructure.
The Nuclear Power Corporation of India Limited said the exposed files did not affect nuclear safety or security systems at Kudankulam. According to NPCIL, the material related only to conventional balance-of-plant service facilities covered under a public tender.
Reliance Group acknowledged a partial breach involving data on a server hosted by Yotta. It said the Indian government and law enforcement had been informed.
Analysis of World Leaks' dark web post indicated that roughly 19,000 files labeled "KKNP" and tied to the Kudankulam Nuclear Power Plant had been circulating online since this date. The files were described as part of a much larger set of about 858,000 Reliance-linked files.
Yotta said it detected suspicious activity on a server it hosted for Reliance Infrastructure and prevented suspected ransomware execution. The provider later said it could not verify subsequent breach claims tied to the incident.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcetheravenfile.com
Open sourcecyberveille.ch
Open sourcecysecurity.news
Open sourceteiss.co.uk
Open sourceteiss.co.uk
Open sourcemalware.news
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese cybersecurity firm KnownSec suffered a significant data breach, resulting in the leak of over 12,000 internal documents. The files, briefly posted on GitHub before removal, reportedly include details on KnownSec's contracts with Chinese government and military entities, internal hacking tools, and a spreadsheet listing 80 overseas targets. Analysis of the leaked data suggests the presence of remote access trojans (RATs) capable of compromising Linux, Windows, macOS, iOS, and Android systems, with some tools able to extract data from popular messaging apps such as Telegram and Chinese platforms. The breach also exposed large datasets, including 95GB of Indian immigration data, 3TB of call records from South Korea's LG U Plus, and 459GB of Taiwanese road planning data. Security researchers and analysts have described the leak as an intelligence gold mine, providing rare insight into the operations of a major Chinese cyber contractor. While the exact motivation behind the leak remains unclear—whether it was the act of a disgruntled insider or an external hack-and-dump operation—the incident highlights the scale and scope of KnownSec's cyber activities, including its role in mapping foreign digital infrastructure and developing tools for state-sponsored operations. The exposure of these documents is likely to have significant implications for both Chinese cyber operations and the security of the affected international targets.
Jun 29, 2026
A broad exposure of **Chinese state-linked sensitive data** resurfaced across underground and open reporting, combining claims of a massive leak from the **National Super Computer Center in Tianjin** with renewed circulation of previously stolen **Knownsec** corporate documents. One report described a threat actor using the name `airborneshark1` and the alias **Flaming China** to advertise an alleged **10 PB** dataset purportedly taken from the NSCC, a government-owned high-performance computing environment used by academic institutions, state-owned enterprises, and military-affiliated research partners. The available sample data was assessed by the source as likely genuine, although the full scale of the claimed exfiltration remains unverified and may imply prolonged access or insider assistance if authentic. Separately, a partial re-release of the **Knownsec** leak revived reporting on more than **12,000 classified documents** allegedly exposing the internal capabilities of a major Chinese cybersecurity firm tied to government and military work. The leaked material reportedly included multi-platform **RATs**, Android malware targeting chat data, hardware-based collection tools such as a malicious power bank, and spreadsheets identifying overseas targets in more than 20 countries, alongside evidence of large-scale data theft from India, South Korea, and Taiwan. The Kazakhstan **Daryn Online** and Tanzania **BRELA** breach reports describe unrelated criminal data-sale listings and do not match the China-focused state-linked leak activity covered in the relevant reporting.
Jun 29, 2026
India is investigating a suspected cyberattack on Tata Electronics after a threat actor claimed to have breached the company’s internal network and leaked more than **630 GB** of data spanning over **204,300 files**. The exposed material reportedly includes confidential Apple supplier specifications, component and supplier lists, internal code names, testing photos, and images tied to unreleased **iPhone 18 Pro** and **iPhone 18 Pro Max** models, along with documents linked to Tesla, TSMC, and Qualcomm. Reports said the stolen files had been circulating on the dark web since at least June 10, and the extortion and ransomware group **World Leaks** was identified as the actor behind the publication. Tata Electronics said it detected a data incident on some systems weeks earlier, activated incident-response protocols immediately, and maintained that business operations were not affected. The company reportedly restricted internal access to sensitive systems and brought in a global consultant for a forensic audit, while Indian officials said the case had been reported to **CERT-In** and the Ministry of Electronics and Information Technology opened a probe. Apple said it was concerned, was investigating the exposure, and was working with Tata on longer-term security measures.
Jul 7, 2026