Hundreds of applications exposed in censor board data breach

A data breach at the Central Board of Film Certification (CBFC) exposed information from applications for more than 500 titles, dozens of which were feature films, The Hindu found.

Editorial | Hiding the scissors: On the Central Board of Film Certification

The leak appears to have originated from the e-Cinepramaan portal, launched nearly a decade ago to digitise the CBFC’s work. The exposed material includes detailed shooting scripts, cut orders and other documents submitted by filmmakers seeking certification for their films to be screened in Indian cinemas. The breach did not expose any feature films themselves, which are usually handled separately.

The documents, packaged as datasets that could be freely downloaded from the non-profit Internet Archive website, remained accessible for days. Such documents are not typically published by the censor board. Most were posted earlier this month, but all had been taken down on October 12. The user who uploaded the documents had used a display name in Russian corresponding to that of former CBFC chairman Prasoon Joshi. The account has since been deleted. The Hindu was unable to contact the user. The records date from December 2025 to August 2026.

The CBFC said in response to a query from The Hindu that it was looking into the breach. “CBFC has reviewed the information shared regarding alleged unauthorised access to CBFC’s eCinePramaan Portal,” the board saidin a statement from chairperson Shashi Shekhar Vempati’s office. “However, based on the information examined so far, no trace has been found of the certification-related documents that were claimed to have been accessed.”

An Internet Archive spokesperson told The Hindu that the account in question had been taken down by the user. “As a matter of caution, a complaint has been filed with cybercrime authorities, and the Indian Computer Emergency Response Team [CERT-In] has also been notified of the allegations and provided with the information shared,” the CBFC added in its statement.

“The technical team has also conducted a thorough analysis of the servers and databases to assess whether any external attacks may have compromised their security. The findings of this analysis are being considered alongside the ongoing forensic examination,” the statement said.

On October 4, the e-Cinepramaan portal was unavailable for hours. The user stopped uploading any further documents shortly thereafter. No individual filmmaker’s account appeared to have been compromised, the CBFC said, and committed to a “thorough security audit” of the portal. 

Commercially sensitive

The exposed records include local distribution agreements for films like Brazilian Academy Award nominee “The Secret Agent” and the Hollywood film “Good Luck, Have Fun, Don’t Die”. At least three of the agreements identified by The Hindu revealed the fees paid for licensing the films.  

The disclosure of such details could be commercially sensitive and potentially damaging, lawyers who reviewed excerpts of the exposed records told The Hindu.

“Commercial agreements in the film industry often contain carefully negotiated provisions governing creative control, casting, remuneration, profit-sharing, intellectual property rights, promotional obligations, and even specific conditions concerning a film’s storyline, portrayal or production,” Vasundhara S., managing partner at Verum Legal, told The Hindu. 

“When commercially sensitive or specially negotiated creative terms enter the public domain, the confidentiality underpinning these agreements is compromised,” Ms. Vasundhara said. “Such disclosures can weaken negotiating positions, reveal commercially valuable information, influence future contractual negotiations and potentially expose parties to disputes arising from confidentiality obligations.”

“If I am a competing party or a counterparty, I’d be in a much better position to negotiate now that I have confirmation as to what terms these guys would agree to for certain types of works, beyond what is generally known in the market,” said Abhinav Hansaraman, a commercial lawyer in Delhi.