New Delhi: A major cybersecurity incident has hit the entertainment industry. A significant data breach at the Central Board of Film Certification, or CBFC, has exposed confidential documents linked to more than 500 film titles through its digital portal, The Hindu reported Sunday.
The leaked files included shooting scripts, details of cuts ordered by the censor board and agreements showing how much distributors paid for the rights to release films in India. Many of the titles affected were feature films, but the films themselves were not leaked.
The leak originated from the CBFC’s e-Cinepramaan portal, an online system used by filmmakers to submit their movies and documentation for official theatrical clearance. The exposed data, spanning from December 2025 to August 2026, was found openly available on the Internet Archive before being taken down on October 12.
It is still unclear how they were obtained from the website.
The person who uploaded the documents had used former CBFC chairman Prasoon Joshi’s name, written in Russian, as their username. The account has since been deleted. The Hindu, however, failed to contact the person behind it.
The newspaper found that some of the scripts had been prepared specifically for the censor board and included descriptions of individual shots, translations and notes explaining dialogue. One even had swear words marked out.
The files also included lists of cuts and changes ordered by the CBFC. This information is supposed to be available to the public under the Cinematograph Act, 1952, but the board’s website has been showing an “under maintenance” message instead, the report states.
Also read: ‘That’s not feminism, that’s bullying’—Rashmika slams trolls after Koffee with Karan backlash
‘Unclear who leaked the documents’
The leaked documents also included distribution agreements for films such as the Brazilian film The Secret Agent and the Hollywood film Good Luck, Have Fun, Don’t Die. The Hindu found at least three agreements that showed how much had been paid for distribution rights. In some cases, the amounts had not been blacked out properly.
These amounts are usually kept private between companies. Delhi-based commercial lawyer Abhinav Hansaraman told The Hindu that knowing what terms a company has agreed to in the past could help others negotiate better deals.
“If I am a competing party or a counterparty, I’d be in a much better position to negotiate now that I have confirmation as to what terms these guys would agree to for certain types of works, beyond what is generally known in the market.”
The CBFC told The Hindu that it was looking into the reported breach.
In a statement from chairperson Shashi Shekhar Vempati’s office, the board said, “CBFC has reviewed the information shared regarding alleged unauthorised access to CBFC’s eCinePramaan Portal. However, based on the information examined so far, no trace has been found of the certification-related documents that were claimed to have been accessed.”
The board said it had filed a complaint with cybercrime authorities and informed the Indian Computer Emergency Response Team (CERT-In), which handles cybersecurity incidents.
The CBFC also told The Hindu that its technical team had examined the servers and databases to check if there had been any external attacks. It said there was no indication that individual filmmakers’ accounts had been accessed without permission and that it was committed to a “thorough security audit” of e-Cinepramaan.
The Internet Archive said that the person who uploaded the documents had deleted their account. It is still unclear who leaked the documents or how they got hold of them.
(Edited by Saptak Datta)