India Film Board Data Breach Exposes Unreleased Scripts, 500+ Film Titles

Key Takeaways

• India’s Central Board of Film Certification (CBFC) is investigating a data breach impacting its e-Cinepramaan portal.
• Confidential documents related to over 500 film titles, including unreleased scripts and private contracts, were reportedly exposed.
• The exposed data appeared on the Internet Archive, raising concerns about intellectual property theft and competitive intelligence.
• The CBFC has initiated an investigation and security audit, stating no evidence of further unauthorized access or account compromises has been found.

Film Board Data Breach Exposes Unreleased Scripts and Sensitive Contracts

India’s Central Board of Film Certification (CBFC) is currently investigating a significant data breach that reportedly exposed confidential documents associated with more than 500 film titles. The sensitive information, which includes shooting scripts, censor cut orders, certification files, and private distribution agreements, was allegedly accessed via the board’s e-Cinepramaan portal.

The exposure was initially reported by The Hindu, clarifying that the incident involved film certification applications rather than leaked movie files themselves. This distinction is crucial, as it indicates the breach exposed administrative and contractual data for hundreds of titles, not necessarily 500 complete film copies or scripts. Dozens of feature films are among the affected productions.

Sensitive Business Records and Unreleased Content Exposed

Filmmakers utilize the e-Cinepramaan portal to submit all necessary documentation for film certification prior to their theatrical release. Reports indicate that the files were allegedly accessed through this portal and remained publicly available online for several days before being removed.

The compromised material reportedly surfaced on the Internet Archive, where it was available for download. According to Digit’s analysis of the findings, documents with dates ranging from December 2025 to August 2026 were among the records exposed.

The potential commercial ramifications extend beyond mere plot spoilers. Reportedly, local distribution agreements for films such as “The Secret Agent” and “Good Luck, Have Fun, Don’t Die” were included in the exposed data. At least three of these agreements disclosed licensing fees, potentially revealing private deal terms that could be exploited by competitors or influence future negotiations for filmmakers.

For films yet to be released, the exposure of scripts could prematurely reveal storylines, undermining carefully planned marketing campaigns. Similarly, censor cut orders could disclose scenes removed during the certification process. While these are significant potential consequences, there is no confirmation yet of actual financial losses or misuse stemming from the reported exposure.

Investigation Underway, Portal Outage Noted

The CBFC has confirmed it has launched an investigation into the incident and is conducting a comprehensive security audit. The board stated that its initial checks have not uncovered evidence of further unauthorized access to the documents identified in the report. Furthermore, there is no indication that individual filmmakers’ accounts have been compromised.

According to India Today’s coverage, uploads to the portal ceased after it became unavailable for several hours on October 4. However, the timing of this outage alone does not definitively establish the method of access or confirm that the outage itself halted the exposure.

The Internet Archive reportedly removed the account associated with the exposed materials. A complaint has been filed with cybercrime authorities, and the Indian Computer Emergency Response Team (CERT-In) has been notified. The full extent of the data exposure remains under investigation.

Current public reporting does not identify a confirmed software vulnerability or specific access method exploited in this incident. While similar document exposures involving broken access controls have been reported for other Indian government portals, there is no evidence linking those weaknesses to the CBFC breach. Key questions persist regarding how the documents became accessible, precisely which submissions were affected, and whether copies of the data remain elsewhere. Until investigators release their findings, claims of stolen passwords, ransomware attacks, or specific vulnerabilities remain unsubstantiated by the publicly available information.

What You Should Do

• For Filmmakers and Production Houses: Monitor your intellectual property and contractual agreements for any unauthorized dissemination or unusual activity. Review any recent submissions made via the e-Cinepramaan portal.
• For CBFC Users: Be vigilant for any suspicious communications or phishing attempts that might leverage information from the breach.
• For the CBFC: Continue a thorough forensic investigation to identify the root cause, scope of the breach, and implement robust security enhancements to prevent future incidents.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.