MediaNama · বিনোদন

CBFC data breach exposed movie scripts, censor cuts summaries and distribution deals of 500+ films: Report

10/27/2026

A reported data breach at the Central Board of Film Certification (CBFC) exposed documents submitted as part of certification applications for more than 500 titles, including dozens of feature films, The Hindu’s Aroon Deep reported on October 25, 2026. The leaked data reportedly included film scripts, details of cuts mandated by the CBFC, and sensitive distribution agreements, some of which contained unredacted financial information.

The leak appears to have originated from the e-Cinepramaan portal, which filmmakers use to submit applications for certification. CBFC certification is mandatory for films released theatrically in India. The exposed records reportedly date from December 2025 to August 2026. According to The Hindu, the documents were packaged as datasets and uploaded to the Internet Archive, where they could be freely downloaded for days. Most were posted earlier this month, and all were taken down on October 12. The uploader’s display name was reportedly a Russian rendering of the name of former CBFC chairman Prasoon Joshi. The Internet Archive account has since been deleted. However, MediaNama has not independently reviewed the leaked documents.

What was leaked? In its explainer on the leak, The Hindu said the leaked data contained:

Shooting scripts: The leaked materials reportedly included scripts with detailed shot-by-shot translations and annotations. One script reportedly carried labels on swear words and clarifications on dialogue.
Summaries of cuts mandated by the CBFC: The Hindu notes this is supposed to be public information under Section 5A(2) of the Cinematograph Act, 1952, but the board had put such data behind an “under maintenance” message on its website.
Film distribution agreements were exposed: The exposed documents reportedly included distribution agreements for international films released in India and Indian films licensed for dubbing into other languages.

These include local distribution agreements for films such as Brazil’s Oscar-nominated The Secret Agent and the Hollywood film Good Luck, Have Fun, Don’t Die. According to The Hindu, at least three agreements disclosed film licensing fees because the relevant information was either unredacted or inadequately redacted.

What is CBFC’s response after the breach? While Internet Archive told The Hindu that the user had deleted the account, according to a few excerpts from The Hindu’s report, this is what CBFC has said:

“CBFC has reviewed the information shared regarding alleged unauthorised access to CBFC’s eCinePramaan Portal…However, based on the information examined so far, no trace has been found of the certification-related documents that were claimed to have been accessed.”

“As a matter of caution, a complaint has been filed with cybercrime authorities, and the Indian Computer Emergency Response Team [CERT–In] has also been notified of the allegations and provided with the information shared.”

“The technical team has also conducted a thorough analysis of the servers and databases to assess whether any external attacks may have compromised their security. The findings of this analysis are being considered alongside the ongoing forensic examination.”

The CBFC said it had found ‘no trace of the documents’ allegedly accessed, yet it has filed a complaint with cybercrime authorities, notified CERT-In and is conducting a forensic examination as “a matter of caution”.

Indian organisations have repeatedly been accused of denying reported cybersecurity breaches or downplaying the severity of attacks. This was seen in MeitY’s response to reports about weak private keys associated with eMudhra-issued certificates used to certify websites and the State Bank of India’s response to a data breach of over three lakh consumers, which termed it as “very very small.” Or, sometimes, the data found on the dark web mismatches with the leak accepted by the organisation, as happened with the Dodo Payments case.

A brief list of a few breaches in India:

October 2026: SBI confirmed a suspected breach involving 3,897 customer records that appeared on the dark web, but has been silent on whether affected customers were informed.
September 2026: Dodo Payments said a breach of its internal analytics system did not expose credentials, but a dark web listing reviewed by MediaNama claims the stolen data includes API keys, KYC records and customer data.
August 2026: HCLTech said it found no evidence of a breach of its systems and that the leaked employee data may be limited and years old.
July 2026: Bank of Baroda began a forensic probe after customer data appeared on the dark web. MediaNama also found files linked to the Kudankulam Nuclear Power Plant project in leaked Reliance data on a ransomware site, and researchers found security flaws in UMANG that allegedly exposed EPFO, LPG and Aadhaar-linked data.
June 2026: Bajaj Auto confirmed a ransomware attack on its systems and technology subsidiary, and Ultrahuman notified users more than two months after a March 27 attack.
May 2026: A student researcher demonstrated access to CBSE’s On-Screen Marking portal after officials denied his earlier findings, and HDFC AMC reported a cybersecurity incident to the stock exchanges.

The CBFC and online censorship: To be clear, the CBFC has no jurisdiction over online content, including films and series. Although the CBFC’s censorship decisions have drawn criticism, concerns about content restrictions extend beyond theatrical releases to online streaming platforms.

The case of Punjab ’95, briefly released on streaming platforms as Satluj, raises questions about whether the CBFC’s influence extends beyond theatrical releases. The film, about human-rights activist Jaswant Singh Khalra, was reportedly held up by the board for over three years, which sought over 127 cuts. When it was released on Zee5, it was pulled in India within around 48 hours. However, there is no official notice of whether the Ministry of Information and Broadcasting (MIB), the Ministry of Electronics and Information Technology (MeitY) or the CBFC has sent notices or asked Zee5 to remove it from its OTT platform.

Proposals for a CBFC-style system of content classification for streaming platforms have also raised concerns about potential censorship. In September, the Rashtriya Swayamsevak Sangh (RSS) reportedly formed an informal group to propose OTT regulation, with a source saying the group wants “something like a censor board” for the online streaming industry.