A ransomware attack on a Kudankulam nuclear project contractor compromised sensitive data, including ventilation layouts and floor plans. This incident underscores India’s opaque breach disclosure and organizations’ immature cybersecurity practices, treating it as compliance. Although the NPCIL claims the core nuclear infrastructure is unaffected, the stolen data could assist intelligence activities. India, a frequently breached country, needs urgent improvements. The author criticizes delayed official communication and urges CERT-In and NPCIL for radical transparency regarding file authenticity, data exfiltration, and exposed credentials, emphasizing proactive communication and robust cyber-hygiene.