Censor board data breach exposed scripts and film deal terms from 500-plus applications

Documents from applications for more than 500 titles submitted to the Central Board of Film Certification (CBFC) were exposed in a data breach and could be freely downloaded online for days, The Hindu reported on Sunday, October 25. Dozens of the titles were feature films.

The leak appears to have come from e-Cinepramaan, the online portal the CBFC launched nearly a decade ago to digitise film certification. The exposed material includes detailed shooting scripts, cut orders and other documents that filmmakers submit when seeking a certificate for cinema release. No films themselves were exposed, the report said.

According to The Hindu, the documents were packaged as datasets on the non-profit Internet Archive website. Most were posted earlier this month, and all had been taken down by October 12. The records date from December 2025 to August 2026. The uploader’s display name was written in Russian and matched the name of former CBFC chairman Prasoon Joshi; the account has since been deleted, and the newspaper said it could not contact the user.

Among the exposed records are local distribution agreements for films including the Brazilian Academy Award nominee The Secret Agent and the Hollywood film Good Luck, Have Fun, Don’t Die. At least three of the agreements showed the fees paid to license the films, the report said.

In a statement from chairperson Shashi Shekhar Vempati’s office, the board said: “CBFC has reviewed the information shared regarding alleged unauthorised access to CBFC’s eCinePramaan Portal. However, based on the information examined so far, no trace has been found of the certification-related documents that were claimed to have been accessed.”

“As a matter of caution, a complaint has been filed with cybercrime authorities, and the Indian Computer Emergency Response Team [CERT-In] has also been notified of the allegations and provided with the information shared,” the statement added. The CBFC said its technical team had analysed its servers and databases for any external attack, and that the findings were being considered alongside an ongoing forensic examination.

The portal was unavailable for hours on October 4, and the uploader stopped posting documents shortly afterwards. The CBFC said no individual filmmaker’s account appeared to have been compromised and committed to a “thorough security audit” of the portal. An Internet Archive spokesperson told The Hindu the account had been taken down by the user.

Lawyers who reviewed excerpts of the records said the disclosure could hurt the companies involved. “When commercially sensitive or specially negotiated creative terms enter the public domain, the confidentiality underpinning these agreements is compromised,” said Vasundhara S., managing partner at Verum Legal.

“If I am a competing party or a counterparty, I’d be in a much better position to negotiate now that I have confirmation as to what terms these guys would agree to for certain types of works, beyond what is generally known in the market,” Delhi-based commercial lawyer Abhinav Hansaraman told the newspaper.