As of 2:45 PM IST, Sunday 25 October 2026. This story is based on an investigation published by The Hindu early on Sunday, 25 October, and follow-up reporting by India Today and NDTV Profit. The CBFC's investigation is still going on and the full extent of the exposure is not yet known. HorizonDesk has not seen or accessed the leaked documents.
A data breach at India's film certification body, the Central Board of Film Certification (CBFC), exposed documents from applications for more than 500 titles, dozens of them feature films, The Hindu reported on Sunday. The files included shooting scripts, cut orders and commercially sensitive distribution agreements. The breach appears to have come through e-Cinepramaan, the online portal filmmakers use to apply for certification.
What was exposed
- Shooting scripts submitted with certification applications.
- Cut orders, which are the CBFC's instructions on scenes to be removed or changed before release.
- Distribution agreements. The Hindu said these included local distribution contracts for the Brazilian Oscar nominee The Secret Agent and the Hollywood film Good Luck, Have Fun, Don't Die. At least three agreements showed the fees paid to license films.
The films themselves were not exposed. They are usually submitted through a separate process.
How the files got out
According to the reports, the documents could be downloaded for days from an account on the Internet Archive, the non-profit digital library. The Internet Archive told The Hindu it had taken the account down and filed a complaint with cybercrime authorities. India's national cyber-security agency, CERT-In, was also notified.
The CBFC said the person uploading the files stopped after the e-Cinepramaan portal went offline for several hours on 4 October. Exactly how the documents were taken from the portal has not been publicly explained.
What the CBFC says
The board said it was investigating and carrying out a security audit of the portal. It said it had reviewed the information about the unauthorised access and had found no evidence of further access to the exposed documents. It also said no individual filmmaker's account appeared to have been compromised.
Why it matters
Scripts and cut orders can reveal plot details and creative decisions before a film's release. Distribution contracts can contain licensing fees, revenue-sharing terms and rights clauses that companies normally keep confidential. If competitors can see those terms, it could affect future negotiations between producers, distributors and exhibitors.
The breach is also the latest example of an ageing government portal holding sensitive business data. e-Cinepramaan was launched almost a decade ago to digitise certification. It comes during a difficult period for web security: in the past few weeks, critical flaws in PHP and supply-chain attacks on software vendors have forced emergency fixes worldwide.
What filmmakers and producers can do
- Review what was submitted through e-Cinepramaan and check whether any of it has appeared publicly.
- Change portal passwords and turn on any extra login protection offered.
- Talk to distribution partners if contract terms may have been exposed.
- Watch for official updates from the CBFC on the audit's findings.
What is still unclear
- How the files were taken from the portal, and whether a security flaw was exploited.
- Exactly which films and companies were affected, and whether they will be told.
- When the security audit will finish and whether its findings will be made public.
Related reading on HorizonDesk
- PHP2Shell: AI-found PHP flaws take government websites offline
- Storm-0940 and the ConnectWise supply-chain attack
- How to tell if your phone is hacked, and what to do
