India’s Central Board of Film Certification (CBFC) is investigating a reported data exposure that left confidential certification documents for hundreds of films accessible online. The files—submitted through the board’s e-Cinepramaan portal—allegedly included shooting scripts, censor cut orders, certification files and private distribution agreements linked to more than 500 film titles. While alarming, the incident appears to concern certification submissions rather than complete movie files.
What was exposed
Reports indicate the exposed material included a range of production and business documents: shooting scripts, instructions about required cuts, official certification paperwork and distribution contracts. Some distribution agreements reportedly disclosed licensing fees, potentially revealing private commercial terms. The affected records are said to span submissions dated from December 2025 through August 2026.
How the files surfaced
According to news coverage, portions of the material were uploaded to the Internet Archive where they remained available for download for a period before removal. The uploads reportedly appeared after the CBFC portal became unavailable for several hours on October 4, when uploads stopped. The Internet Archive later removed the account associated with the files.
Potential impacts for filmmakers and distributors
For unreleased films, exposed scripts and cut orders can reveal storylines and editorial decisions ahead of planned marketing and release strategies. For commercial agreements, visible licensing fees and contract terms could affect negotiations or reveal competitive deal information. It is important to note that published reporting frames these outcomes as potential consequences; there is no public evidence in the reporting that financial losses or misuse have occurred.
Official response and investigation steps
The CBFC has said it launched an investigation and a security audit, and its initial checks reportedly did not find evidence of wider access to the identified documents. The board also stated there was no indication that individual filmmakers’ accounts had been compromised. Cybercrime authorities received a complaint, and India’s Computer Emergency Response Team (CERT-In) was notified as part of the ongoing inquiry.
Unanswered questions and context
Available reporting does not confirm how the documents became accessible, whether a software vulnerability, misconfiguration or credential compromise was involved, or whether copies remain elsewhere. Past incidents involving exposed government portals have sometimes involved broken access controls, but investigators have not established any link between those cases and this CBFC exposure. Until investigators publish findings, claims about stolen passwords, ransomware or a specific exploitation method remain unsupported by public sources.
What to watch next
The important developments to monitor are the results of the CBFC’s security audit, any formal statements from CERT-In or law enforcement about an attack vector, and whether affected parties report demonstrable harm. For now, the incident highlights how sensitive certification and distribution documents—distinct from finished film content—can carry commercial and creative risk when they become exposed.
Licensed under CC BY-ND 4.0 International