The story so far:A data breach at the Central Board of Film Certification (CBFC) left hundreds of applications’ data exposed online, The Hindu found. The data comes from over 500 titles, of which dozens are feature films. The leak comes from the censor board’s e-Cinepramaan portal, used by filmmakers to submit their applications. The records ranged from December 2025 to August 2026.
Leaked documents
The leaked documents included shooting scripts, with detailed shot-by-shot translations and other annotations. These scripts appear to have been specifically prepared for the censor board’s review of these films — one script even included labels on swear words used over the course of the film and other clarifications on dialogue.
The breached data also included a summary of cuts that were ordered by the CBFC. This is supposed to be public information anyway under Section 5A(2) of the Cinematograph Act, 1952, but the censor board put this data behind an “under maintenance” message on its website.
In what could be the most sensitive of the exposed documents, film distribution agreements — both from international filmmakers distributing into India and Indian filmmakers authorising dubbed versions in a different part of the country — were exposed. At least three such agreements had unredacted or improperly redacted information on what fees were paid to license a film for distribution in India. The Hindu is withholding specifics here.
“Commercial agreements in the film industry often contain carefully negotiated provisions governing creative control, casting, remuneration, profit-sharing, intellectual property rights, promotional obligations, and even specific conditions concerning a film’s storyline, portrayal or production,” Vasundhara S., managing partner at Verum Legal told The Hindu.
“When commercially sensitive or specially negotiated creative terms enter the public domain, the confidentiality underpinning these agreements is compromised,” Ms. Vasundhara said. “Such disclosures can weaken negotiating positions, reveal commercially valuable information, influence future contractual negotiations and potentially expose parties to disputes arising from confidentiality obligations.”
“If I am a competing party or a counterparty, I’d be in a much better position to negotiate now that I have confirmation as to what terms these guys would agree to for certain types of works, beyond what is generally known in the market,” Abhinav Hansaraman, a commercial lawyer in Delhi said.
Internet Archive
The documents were posted as dockets that contained practically everything but a copy of the film itself, and posted on the site of the non-profit Internet Archive portal. The data dump, most of it was posted on a single day, lay on the site for days, open to anyone to review and download. It is unclear if the data dump’s existence was known to anyone.
The majority of the documents were posted earlier this month, but were all taken down on October 12. The user, whose display ID was former CBFC chairman Prasoon Joshi’s name in Russian, also deleted their account. The Hindu was unable to contact them.
CBFC investigating
Last week, The Hindu contacted the CBFC for comment on the breach. The censor board did not appear to have immediate information on the breach. A week after being provided granular details of what documents were leaked from which film application, CBFC chairperson Shashi Shekhar Vempati said in a statement that it was looking into the breach. “CBFC has reviewed the information shared regarding alleged unauthorised access to CBFC’s eCinePramaan Portal,” the CBFC said. “However, based on the information examined so far, no trace has been found of the certification-related documents that were claimed to have been accessed.”
The Internet Archive told The Hindu in a statement that the account in question was taken down by the user themselves. “As a matter of caution, a complaint has been filed with Cybercrime, and CERT-In has also been notified of the allegations and provided with the information shared,” the CBFC added in its statement to The Hindu. CERT-in is India’s computer emergency response team, which is tasked with handling data breach and hacking incidents.
“The technical team has also conducted a thorough analysis of the servers and databases to assess whether any external attacks may have compromised their security,” CBFC added. “The findings of this analysis are being considered alongside the ongoing forensic examination.”
On October 4, the e-Cinepramaan portal was unavailable for hours. The user stopped uploading any further documents shortly thereafter. No individual filmmaker’s account seems to have been compromised, the CBFC said in its statement, and committed to a “thorough security audit” of the e-Cinepramaan portal.
“During this period, CBFC’s film certification operations continued uninterrupted, and no user complaints regarding system non-availability were received,” CBFC added.