Critical Infrastructure Cybersecurity in India | UPSC

UPSC Mapping

Article

Critical Infrastructure Cybersecurity has emerged as a major national security concern following reports of a ransomware-linked data exposure involving a third-party service provider associated with the Kudankulam Nuclear Power Plant. The reported incident involved approximately 19,000 files containing 14.3 GB of information. It highlights how vulnerabilities in contractors and cloud platforms can threaten sensitive national assets without necessarily compromising their core operational systems. For related developments, explore the daily current affairs archive.

The incident has renewed attention to cybersecurity governance, supply-chain security and the protection of India’s strategic digital infrastructure. It is particularly relevant to UPSC GS Paper III, which covers cybersecurity, internal security challenges and the protection of critical infrastructure.

Prelims Package

What is Critical Infrastructure Cybersecurity?

Critical Infrastructure Cybersecurity refers to protecting the digital systems, operational technologies, communication networks and sensitive information supporting essential national services. These services include electricity, banking, telecommunications, transport, healthcare, defence and nuclear energy.

India’s Information Technology Act, 2000 defines Critical Information Infrastructure (CII) under Section 70 as a computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or public safety.

Modern infrastructure depends on interconnected information technology and operational technology. Even when a strategic facility isolates its operational network, contractors may store project designs, maintenance records and procurement documents elsewhere. These external systems create additional security risks.

Why in News?

Reports in October 2026 linked a ransomware-related data exposure involving technology service provider Yotta to documents concerning the Kudankulam Nuclear Power Plant in Tamil Nadu. The reported dataset comprised approximately 14.3 GB of files, including engineering drawings, inspection documents and contracts dating from 2016 to 2025.

The allegations concern information associated with an external service-provider ecosystem. Public reporting does not, by itself, establish that nuclear reactor controls or safety systems were compromised. This distinction matters because a contractor data breach and an intrusion into operational technology have different security implications.

The case illustrates a growing vulnerability: attackers can target outside suppliers to access sensitive information without directly entering a protected strategic facility. Such incidents demand a broader approach to data ownership, vendor accountability and cyber risk management.

Key Features of India’s Cybersecurity Challenge

• Increasing digital dependence: Strategic installations rely on networked equipment, specialised software, outsourced maintenance and cloud-based services.
• Interconnected supply chains: Contractors and technology vendors may handle sensitive information outside directly controlled government networks.
• IT-OT convergence: Integration between information technology and industrial control systems expands potential attack surfaces.
• National security implications: Attacks may disrupt essential services, expose classified information or weaken public confidence.
• Cross-border threats: Cybercriminal groups and sophisticated foreign actors can operate across jurisdictions, complicating investigation and attribution.

Cybersecurity in India: Key Data and Trends

According to figures reported to Parliament, CERT-In tracked 29,44,248 cybersecurity incidents in 2025, compared with 15,92,917 in 2023. This represents an increase of approximately 85% over two years.

The rise reflects a growing volume of detected and reported threats. Incident statistics do not necessarily represent unique successful attacks or breaches of critical installations.

In 2025, CERT-In also issued 1,530 security alerts, 390 vulnerability notes and 65 advisories. These measures support threat detection, vulnerability management and coordinated incident response.

Source: Ministry of Home Affairs cybersecurity statistics and PIB backgrounder on CERT-In.

Existing Legal and Institutional Framework

India uses multiple agencies and legal provisions to protect critical digital infrastructure. Their responsibilities cover preventive safeguards, incident reporting, threat intelligence and emergency response.

Prelims distinction: Section 70 concerns protected systems; Section 70A provides for the national nodal agency protecting critical information infrastructure; and Section 70B establishes CERT-In’s statutory role.

The CERT-In Directions, 2022 require specified cybersecurity incidents to be reported within six hours of noticing them or being informed of them. Covered entities must also retain relevant ICT system logs for a rolling period of 180 days.

Major Threats to Critical Infrastructure

• Third-party compromise: Attackers exploit weaker security practices among suppliers, contractors and cloud providers.
• Ransomware and double extortion: Criminals may steal information and threaten disclosure while demanding payment.
• Advanced Persistent Threats: Sophisticated attackers maintain long-term access for espionage, data theft or disruption.
• Credential theft: Phishing and compromised accounts may provide unauthorised access to sensitive organisational systems.
• Industrial control system attacks: Malware targeting operational technology can threaten industrial processes and essential public services.
• Data governance gaps: Proprietary engineering information may require contractual and sector-specific safeguards beyond personal data protection obligations.

The Digital Personal Data Protection Act, 2023 primarily regulates digital personal data. It should not be treated as a comprehensive security law for industrial designs, technical schematics or other non-personal strategic information.

Challenges in Securing Strategic Infrastructure

• Fragmented responsibilities: Multiple agencies, sector regulators and contractors may have overlapping or unclear operational obligations.
• Legacy systems: Older industrial equipment often lacks modern cybersecurity controls and cannot be upgraded easily.
• Limited vendor visibility: Operators may not know where contractors store, process or transfer sensitive technical information.
• Shortage of expertise: Operational technology cybersecurity requires specialised engineering and security knowledge.
• Attribution difficulties: Cross-border infrastructure, anonymous services and intermediaries complicate identification of attackers.
• Continuity risks: Security updates and emergency shutdowns must account for uninterrupted electricity, transport and other essential services.

Way Forward: Strengthening India’s Cyber Resilience

• Security follows the data: Apply appropriate cybersecurity safeguards wherever strategic information travels, including external vendor systems.
• Zero-trust architecture: Continuously verify identities, devices and permissions instead of assuming that internal network access is trustworthy.
• Vendor security audits: Introduce independent assessments, contractual safeguards and clear incident-reporting responsibilities for contractors.
• Data classification: Restrict access according to sensitivity, apply encryption and delete unnecessary information after its authorised use.
• Regular red-team exercises: Test infrastructure and supplier systems against realistic simulated cyberattacks.
• Stronger institutional coordination: Improve information sharing among NCIIPC, CERT-In, sector regulators and law-enforcement agencies.
• Business continuity planning: Maintain tested offline backups, recovery procedures and incident-response capabilities for essential services.

The long-term objective should be cyber resilience, not merely perimeter defence. Critical infrastructure operators must anticipate breaches, contain damage and restore services safely. Effective governance requires security controls covering the full lifecycle of sensitive information.

Students can connect these issues with national security, technology governance and public administration through the CBL UPSC current affairs platform.

Mains Package

FAQs