India's Film Board Investigates Data Breach Exposing Unreleased Scripts and Business Deals
India's Central Board of Film Certification (CBFC) is investigating a data breach that exposed confidential documents for over 500 film titles, including unreleased scripts and distribution agreements.
India's Central Board of Film Certification (CBFC) is grappling with a significant data breach that has reportedly exposed sensitive documents related to more than 500 film titles. The incident, which is currently under investigation, involved confidential materials submitted through the board's e-Cinepramaan portal, a platform used by filmmakers to obtain certification before theatrical release.
According to reports, the exposed data includes shooting scripts, censor cut orders, certification files, and private distribution agreements. While the breach does not mean entire films were stolen, the disclosure of unreleased scripts could prematurely reveal storylines, potentially impacting marketing campaigns and audience anticipation. Furthermore, the exposure of distribution agreements, some detailing licensing fees, could compromise confidential business terms and negotiations.
The affected documents reportedly span submissions made between December 2025 and August 2026. Initial reports suggest that the compromised files were accessible via the e-Cinepramaan portal for several days before being removed. Some of the documents were allegedly uploaded to the Internet Archive, where they could be downloaded.
The CBFC has initiated an investigation and a security audit to understand the full scope and impact of the breach. The board stated that preliminary checks have not found evidence of further unauthorized access to the identified documents and that individual filmmaker accounts do not appear to have been compromised. The Internet Archive has reportedly removed the account associated with the uploads.
While the investigation is ongoing, the exact method of access and the full extent of the exposure remain unconfirmed. Authorities, including the Indian Computer Emergency Response Team (CERT-In), have been notified, and a complaint has been filed with cybercrime officials. Crucially, no specific software vulnerability, exploit, or attack vector has been publicly identified as the cause of the breach.
This incident highlights the sensitive nature of data handled by regulatory bodies and the potential repercussions of even partial data exposure. The premature revelation of scripts and business deals could have significant commercial implications for the Indian film industry, affecting everything from creative control to financial agreements.
Investigators are working to determine how the documents became accessible, which specific submissions were affected, and whether any copies of the data still exist elsewhere. Until official findings are released, speculation regarding the exact cause, such as stolen credentials, ransomware, or a specific zero-day vulnerability, remains unsubstantiated.
The CBFC's investigation aims to not only identify the cause but also to reinforce its security posture to prevent future incidents, ensuring the confidentiality of sensitive film industry data.