.jpg)
Image: Wikimedia Commons — cinema seats (illustrative image; the leaked CBFC documents themselves are not public and are not shown here).
📌 KEY HIGHLIGHTS
- The Hindu found certification documents for more than 500 titles exposed online, reportedly sourced from the CBFC's e-Cinepramaan portal.
- Exposed material includes shooting scripts, cut orders and distribution agreements — but not the films themselves.
- The files were packaged as downloadable datasets on the Internet Archive and were all taken down by 12 October 2026.
- The CBFC says it has found "no trace" of the claimed access so far, is investigating, and has notified CERT-In and cybercrime authorities.
- Named titles in reports include the Brazilian film The Secret Agent and the Hollywood film Good Luck, Have Fun, Don't Die.
What happened?
India's Central Board of Film Certification (CBFC) — the body that certifies films for public screening in India — is at the centre of a reported data exposure. According to an investigation by The Hindu, published on 25 October 2026, documents linked to more than 500 film titles, including dozens of feature films, were exposed online. The leak appears to have originated from e-Cinepramaan, the portal launched in 2017 to digitise the CBFC's certification work, through which filmmakers submit scripts and other documents when applying for certification.
The exposed documents were packaged as datasets that could be freely downloaded from the non-profit Internet Archive website. Most were posted earlier in October 2026 and remained accessible for days. The uploads reportedly stopped after the portal became unavailable for several hours on 4 October, and all the material had been taken down by 12 October. The Hindu reported that the uploading account used a display name in Russian corresponding to that of former CBFC chairman Prasoon Joshi; the account has since been deleted, and the user could not be contacted.
One important caveat runs through the whole story: the precise technical route by which the documents were accessed has not been conclusively established in the available reporting, and the CBFC disputes that its records were accessed at all. This post therefore describes a reported exposure, not a confirmed hack of the CBFC's systems.
CBFC data breach 500 film scripts leaked explained: what was exposed
The records date from December 2025 to August 2026. Here is what the reports say was in them — and what was not.
| Material | Exposed? | Why it matters |
|---|---|---|
| Shooting scripts | Yes, reported | Can spoil plots of unreleased films |
| Cut orders | Yes, reported | Reveal changes the board asked filmmakers to make |
| Distribution agreements | Yes, reported | At least 3 revealed licensing fees and business terms |
| Certification application records | Yes, reported | Show which films sought Indian certification |
| The films themselves | No | Films are handled separately and were not leaked |
| Individual filmmaker accounts | Unaffected, per CBFC | CBFC says individual accounts were not hit |
Image: Wikimedia Commons — an 8 mm film reel and canister (illustrative image).
The commercial side is where the exposure could bite hardest. Distribution agreements, revenue-sharing terms, intellectual-property clauses and licensing fees are normally closely guarded: if rival negotiators can read what a producer accepted, future deals get harder. Reports name the Brazilian film The Secret Agent and the Hollywood film Good Luck, Have Fun, Don't Die among the affected titles, and note that at least three agreements revealed licensing fees.
What did the CBFC say?
In a statement from the office of chairperson Shashi Shekhar Vempati, the CBFC said it had reviewed the information shared about alleged unauthorised access to the e-Cinepramaan portal, but that "based on the information examined so far, no trace has been found of the certification-related documents that were claimed to have been accessed." The board said it was investigating the alleged unauthorised access, had notified the cybercrime authorities and the Indian Computer Emergency Response Team (CERT-In), and was conducting a security audit of the portal. It also said individual accounts of filmmakers remain unaffected.
That leaves two facts standing side by side: reporters found the documents publicly downloadable for days, and the board says its own checks have so far found no trace of the access. The investigation and audit are what will settle which systems, if any, were actually breached — and whether the exposure came through the portal itself or another route.
Why it matters for India readers
For Indian audiences, this is not just a film-industry story — it is a government-systems story. The e-Cinepramaan portal holds confidential material submitted to a statutory body, and the episode raises the same questions that follow every public-sector data incident: how was the material reached, how long was it public, and what changes after the audit? It follows other recent Indian cybersecurity incidents covered here, including the PHP2Shell exposure affecting government websites and the critical GitLab patch, as well as the actively exploited Collabora and Arista flaws.
For filmmakers, the practical risk is narrower but real: leaked scripts can spoil unreleased films, and leaked deal terms can weaken negotiations. No ransom or blackmail attempts linked to this exposure have been established in the reporting so far.
Should you care?
FAQs
What is the CBFC data breach? The Hindu reported that certification documents for more than 500 film titles were exposed online, apparently sourced from the CBFC's e-Cinepramaan portal. The material was downloadable from the Internet Archive for days before being taken down by 12 October 2026. The CBFC says it has found no trace of the claimed access so far and is investigating.
Were the films themselves leaked in the CBFC data breach? No. The exposed material was paperwork — shooting scripts, cut orders, certification records and distribution agreements — not the films, which are handled separately. That still matters, because scripts can spoil unreleased films and contracts reveal commercially sensitive terms.
What did the CBFC say about the leak? The board said it was investigating the alleged unauthorised access, had notified CERT-In and the cybercrime authorities, and was conducting a security audit of the e-Cinepramaan portal. It said individual filmmaker accounts remain unaffected, and that its checks so far found no trace of the documents claimed to have been accessed.
Which films were affected by the CBFC data leak? The full list of affected titles has not been made public. Reports name the Brazilian film The Secret Agent and the Hollywood film Good Luck, Have Fun, Don't Die, and note that at least three distribution agreements revealed licensing fees. No South Indian films have been publicly named so far.
Takeaway: A reported exposure of 500+ films' certification papers — scripts, cut orders and deals — with the films themselves safe, the CBFC investigating, and an audit under way. Watch for the audit's findings: they will say whether the portal itself was breached.
Follow India Tech on TechByCountry for tomorrow's 6 PM update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
The Hindu — Hundreds of applications exposed in censor board data breach
Digit — CBFC data breach: over 500 film scripts and other sensitive documents reportedly leaked
IBTimes India — CBFC data leak: sensitive documents of over 500 films exposed, investigation underway
NewsBytes — CBFC data leak: sensitive documents of over 500 films exposed
Comments
Post a Comment