India’s Central Board of Film Certification (CBFC) is investigating a reported data breach involving confidential documents linked to more than 500 film titles. The exposed records reportedly include shooting scripts, censor cut orders, certification files and private distribution agreements submitted through its e-Cinepramaan portal.

The Hindu first reported the exposure, which involved film certification applications rather than leaked movie files. Its reporting describes more than 500 affected titles, including dozens of feature films. That distinction matters because the incident does not mean 500 complete films or 500 separate scripts were stolen.

Film Scripts and Business Records Exposed

Filmmakers use e-Cinepramaan to submit documents needed for certification before theatrical release. According to reports, the files were allegedly accessed through this portal and remained available online for several days before removal.

The material reportedly appeared on the Internet Archive, where it could be downloaded. Documents dated from December 2025 to August 2026 were among the exposed records, according to Digit’s coverage of the findings.

The commercial impact could extend beyond spoilers. Local distribution agreements for The Secret Agent and Good Luck, Have Fun, Don’t Die were reportedly included. At least three agreements disclosed licensing fees, potentially revealing private deal terms to competitors or future negotiating partners.

For unreleased productions, exposed scripts could reveal storylines before marketing campaigns begin. Cut orders could also disclose scenes removed during certification. These are potential consequences of the reported exposure, not confirmed cases of financial loss or misuse.

The CBFC has reportedly started an investigation and a security audit. The board said its initial checks had not found evidence of further access to the documents identified in the report. It also said there was no indication that individual filmmakers’ accounts had been compromised.

According to India Today’s coverage, uploads stopped after the portal became unavailable for several hours on October 4. That timing alone does not establish how access occurred or whether the outage stopped it.

The Internet Archive reportedly removed the account involved. Cybercrime authorities received a complaint, and the Indian Computer Emergency Response Team, CERT-In, was notified. The investigation has not yet established the full exposure.

The available reporting does not identify a confirmed software flaw or access method. Cyber Security News previously covered an Indian Post Office portal document exposure involving broken access controls, but there is no evidence linking that weakness to CBFC.

Similarly, its SBI data breach coverage separated exposed records from an unconfirmed entry point. For CBFC, the key unanswered questions remain how documents became accessible, which submissions were affected, and whether copies remain elsewhere. Until investigators publish findings, claims of stolen passwords, ransomware or a specific vulnerability remain unsupported by the available public reporting.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post India’s Film Sensor Board Data Breach – Unreleased Scripts, 500+ Film Titles Exposed appeared first on Cyber Security News.