CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

World Leaks

actor · actor:worldleaks single-source

Data-theft extortion group without encryption; rebrand of Hunters International.

Aliases: Hunters International

Coverage
1
first 2026-05-06 → last 2026-07-16
Latest activity
2026-07-16
World Leaks leaks ~858k files from a Kudankulam nuclear-plant contractor breached at a third-party…
Peak priority
notable
1 notable
Targets
energy
sectors: energy · regions: apac
Sources cited
1
1 hosts

Defender insights

What each entry about World Leaks tells a defender to do, newest first.

2026-07-16NOTABLEWorld Leaks leaks ~858k files from a Kudankulam nuclear-plant contractor breached at a third-party data-centre host, a lesson for energy-CI operators

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed activity

Story timeline

  1. 2026-07-16World Leaks posts ~858,000 files tied to India's Kudankulam nuclear-plant contractor; Reliance confirms a third-party-hosting breach
    active-threatsWorld Leaks leaks ~858k files from a Kudankulam nuclear-plant contractor breached at a third-party data-centre host, a lesson for energy-CI operators

Hunting pivots

Tags
data-breachsupply-chain
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessTrusted Relationship
  • CollectionData from Cloud Storage

Initial Access TA0001

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-07-16/worldleaks-kudankulam-reliance-third-party-hosting-breach · ATT&CK page ↗

Collection TA0009

T1530Data from Cloud Storage×1

Adversaries may access data from cloud storage.

Evidence: 2026-07-16/worldleaks-kudankulam-reliance-third-party-hosting-breach · ATT&CK page ↗

Entries about World Leaks (1)

2026-07-16 · view entry permalink →

NOTABLENATOB2

World Leaks posts ~858,000 files tied to India's Kudankulam nuclear-plant contractor; Reliance confirms a third-party-hosting breach

The data-theft-extortion group World Leaks (the rebrand of Hunters International already tracked in this store) posted roughly 858,000 files on its dark-web leak site attributed to Reliance Group, a contractor involved in India's Kudankulam Nuclear Power Plant (KNPP), the country's largest nuclear facility (The Week / Reuters, 2026-07-15). Reuters reviewed a subset of about 19,000 files dated 2016–2025 that purport to show facility blueprints, supplier details, meeting and inspection records, equipment reviews and insurance policies; the files are only claimed to originate from the plant and their authenticity is not established. Reliance Group confirmed to Reuters that a "partial breach" of its data occurred from a server hosted by Yotta, a third-party Indian data-centre provider, and that the government has been informed; India's CERT-In is investigating and a Nuclear Threat Initiative expert warned the exposure could pose a serious plant-safety risk.

They admitted to Reuters that a "partial breach" of its data had taken place from a server hosted by Yotta, a third-party Indian data centre service provider, and that the government has been informed about the incident.

19,000 of these files appeared to be highly sensitive, the report added, noting that the documents were dated between 2016 and 2025, and reportedly featured blueprints, supplier details, meeting and inspection records, equipment reviews and insurance policies.

The Week (India), relaying Reuters 2026-07-15
incident16 Jul 04:42Zsingle-sourceOpen finding →
Sources: The Week (India), relaying Reuters

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • theweek.in1 (100%)
All cited sources (1)