Files relating to the Kudankulam Nuclear Power Project surfaced on a ransomware group’s dark-web portal — not from the plant, but from a contractor’s data stored with a third-party data centre. The author argues that India protects the facility well but not the ecosystem of contractors and service providers around it.

• The leak: a group called World Leaks began posting parts of about 19,000 files (14.3 GB) from 2016 to about 2025 — engineering drawings, supplier details, inspection records, minutes and insurance papers.
• The route: the data belonged to Reliance Infrastructure, the EPC contractor for Units 3 and 4, and was stored with the data centre Yotta, which confirmed ransomware activity on 29 May.
• Official position: NPCIL said the files concerned non-nuclear infrastructure, unrelated to nuclear-safety systems. Nothing public suggests the air-gapped reactor control or safety systems were reached.
• Precedent: in 2019, Dtrack malware — linked by researchers to North Korea’s Lazarus Group — was found on a computer on the plant’s internet-facing administrative network.

• Perimeter has moved: modern infrastructure is built by many organisations — utilities, EPC firms, suppliers, cloud providers, insurers, certifiers and foreign partners. Each may hold sensitive data that sits outside the plant’s air gap and segmentation.
• Strategic value of “non-sensitive” data: drawings and supplier lists help attackers map contractors, craft phishing lures and find the weakest entry point.
• Accountability gap: obligations fall on the operator of a protected system; once data passes to a contractor or data centre, protection depends largely on contracts. Everyone can truthfully say “our systems were not breached” — yet data still leaks.
• Lesson not learnt: both 2019 and 2026 show exposure at the periphery; the author argues there has been no systematic approach to securing the ecosystem since.

• Security that follows the data: binding standards, liability and audit clauses for every contractor, subcontractor and cloud provider in procurement contracts.
• Data classification and minimisation: vendors hold only the data needed, only for as long as needed.
• Third-party risk assessment: replace annual compliance certificates with independent audits and red-team exercises across the vendor ecosystem.
• Zero trust: assume no network is safe; verify every access point.
• One national framework: CERT-In, NCIIPC, sectoral regulators and operators to converge on critical-infrastructure supply-chain security, assigning responsibility before a breach.

• Fair caveats: ransomware groups often exaggerate their haul; NPCIL’s clarification deserves weight, and the core safety systems appear untouched.
• Strength of the argument: as defence, space, nuclear and power sectors open to private firms and government data moves to commercial clouds, the attack surface grows — a framework designed for State-built, State-run systems no longer fits.
• Implementation cost: stringent vendor audits raise costs for smaller suppliers and could slow projects; standards must be risk-tiered.
• Legal route: whether through a new law or wider use of the IT Act, clear liability across the supply chain is the missing piece.

The authors argue that Double Fortified Salt (DFS) — salt fortified with both iodine and iron — is a proven, cheap way to prevent iron-deficiency anaemia, and that its slow uptake is now an institutional, not a technical, problem. They want it built into the revised Anaemia Mukt Bharat strategy and the Public Distribution System.

• 1962 — National Goitre Control Programme → renamed the National Iodine Deficiency Disorders Control Programme (1992); sale of non-iodised salt for direct human consumption is banned under food-safety rules.
• Universal Salt Iodisation: about 95% of households now use iodised salt — the platform DFS would build on.
• 2018 — Anaemia Mukt Bharat (AMB): launched under POSHAN Abhiyaan with a 6×6×6 strategy — six target groups, six interventions, six institutional mechanisms (e.g. weekly iron–folic acid, deworming, testing, behaviour change).
• 2018 — FSSAI Fortification Regulations: standards for fortified rice, wheat flour, edible oil, milk and salt, marked with the “+F” logo.
• 2021–2024 — Rice fortification rolled out across PDS, PM POSHAN and ICDS; continued to 2028.
• 2026 — revised “7×7×7” AMB strategy, which the authors want to anchor DFS as a preventive pillar.

• Universal consumption in predictable quantities across income and geography.
• No behaviour change needed — unlike iron tablets, which suffer from poor adherence due to side effects.
• Existing infrastructure from iodisation — plants, labs and regulatory systems.

• Sodium paradox: the WHO recommends under 5 g of salt a day; Indians consume well above that. DFS must be designed so it does not encourage higher salt intake — the authors stress alignment with sodium-reduction goals.
• Haemoglobinopathies: iron-fortified foods raised concerns for people with thalassaemia and sickle cell disease during rice fortification; screening and labelling safeguards must accompany scale-up.
• Quality control: many small and medium salt producers need support to meet iron-stability standards; poor-quality DFS can change colour and lose consumer acceptance.
• Not a silver bullet: anaemia also stems from infections, poor diets and other deficiencies — DFS complements, not replaces, dietary diversity, deworming and treatment.
• Federal factor: PDS commodity choices rest with States; central co-financing and procurement support could ease adoption.

• A central flagship for DFS in PDS with dedicated financing, alongside PM POSHAN and ICDS.
• Quality assurance through accredited labs and FSSAI monitoring; support for small producers.
• Consumer awareness and wider open-market availability.
• Integrate DFS monitoring with Anaemia Mukt Bharat dashboards and haemoglobinopathy screening.