Data Breach at India’s Film Certification Board

India’s Central Board of Film Certification (CBFC) is currently probing a reported data breach that has compromised sensitive documents associated with over 500 film titles. These documents, which include shooting scripts, censor cut orders, certification files, and private distribution agreements, were submitted via the board’s online portal, e-Cinepramaan.

Details of the Exposure

The Hindu was the first to report the breach, highlighting that the compromised data pertains to film certification applications rather than leaked films themselves. This is a crucial distinction, as it means full movies or complete scripts were not part of the exposure. More than 500 film titles, including numerous feature films, have been affected.

Impact on the Film Industry

Filmmakers rely on the e-Cinepramaan portal to submit essential documents required for film certification before release. Reports suggest that these files were accessible online for several days before they were removed. According to Digit, the exposed records, dating from December 2025 to August 2026, were available for download from the Internet Archive.

The breach could have commercial ramifications beyond simple spoilers. Distribution agreements for films like ‘The Secret Agent’ and ‘Good Luck, Have Fun, Don’t Die’ were reportedly exposed, including at least three agreements disclosing licensing fees. Such information could potentially be exploited by competitors or future negotiation partners.

Ongoing Investigation and Response

The CBFC has initiated an investigation and a security audit. Preliminary checks have not revealed further unauthorized access to the documents. Additionally, there is no evidence of individual filmmakers’ accounts being compromised, according to the board.

On October 4, the portal was unavailable for several hours, during which uploads ceased. However, this downtime does not clarify how the breach occurred or if it prevented further access. The Internet Archive has since removed the involved account, and cybercrime authorities have been alerted. The Indian Computer Emergency Response Team (CERT-In) is also involved in the investigation, though the full extent of the exposure remains undetermined.

Unresolved Questions and Future Outlook

The investigation has yet to confirm the method of access or identify any specific software vulnerabilities. Previous incidents covered by Cyber Security News, such as the Indian Post Office portal breach, involved broken access controls, but there is no evidence connecting these cases to the CBFC breach.

Unanswered questions include how the documents became accessible, which submissions were affected, and whether any copies remain elsewhere. Until investigators release their findings, claims of stolen passwords, ransomware, or specific vulnerabilities are unsupported by current public reports. Film industry stakeholders are advised to remain vigilant and update defenses against emerging threats.