A shocking data breach has come to light, raising concerns over the security of sensitive information in the Indian film industry. Certification records of over 500 films at the Central Board of Film Certification (CBFC) have reportedly been exposed and leaked. The leaked documents include shooting scripts, cut orders, and distribution agreements. The CBFC is now investigating the breach and conducting a security audit of its portal.
The CBFC uses an online portal called e-Cinepramaan for its certification process, through which filmmakers submit documents when applying for certification.
According to a report by The Hindu, the leaked documents were accessed through this portal. The files reportedly remained accessible online for days, even though many had been uploaded earlier and were subsequently taken down.
Details of information exposed
The leaked files did not include the films themselves but contained shooting scripts, cut orders and other documents submitted during the certification process. These records were available for download through the Internet Archive, a non-profit digital library that preserves online content.
While the scripts and certification details may not reveal everything about a film's plot or production, they could still expose information that filmmakers may not want to make public before a film's release. These included documents related to Brazilian Academy Award nominee The Secret Agentand the Hollywood film Good Luck, Have Fun, Don't Die.
At least three agreements reportedly revealed the fees paid for licensing films. Such contracts may contain commercially sensitive information, including revenue-sharing arrangements, intellectual property rights, promotional obligations and conditions related to a film's storyline or production.
Investigation underway
The CBFC has said it is investigating the breach and conducting a security audit of the portal. It reviewed information about the alleged unauthorised access but found no evidence of further access to the documents claimed to have been exposed.
The Internet Archive confirmed that the account in question had been taken down, and a complaint was filed with cybercrime authorities.
