The Indian film industry is reeling after a massive security lapse exposed confidential documents from the Central Board of Film Certification (CBFC) portal. For several days, sensitive records including detailed shooting scripts, shot-by-shot annotations, and confidential commercial agreements for over 500 films were left accessible on the Internet Archive. The breach involved documentation spanning from December 2025 to August 2026, originating from the e-Cinepramaan portal, which serves as the digital backbone for film certification under the Cinematograph Act of 1952.
Legal experts are sounding the alarm over the potential fallout, as the leaked contracts included private details regarding licensing fees, profit-sharing models, and intellectual property rights. Vasundhara S., managing partner at Verum Legal, noted that public exposure of these terms could severely undermine future negotiations and damage the financial standing of production houses. Notable titles caught up in the leak reportedly include the Brazilian Academy Award nominee The Secret Agent and the Hollywood feature Good Luck, Have Fun, Don’t Die. While actual film files remained secure, the disclosure of these internal documents poses a significant risk to stakeholders across the board.
Digital footprints have linked the uploads to an account using a Russian transliteration of former CBFC Chairperson Prasoon Joshi. The suspicious uploads reportedly continued until the e-Cinepramaan portal went offline for maintenance on October 4, 2026, with the Internet Archive eventually removing the content and deleting the associated account on October 12, 2026, following a formal complaint.
In response, the CBFC has issued a statement claiming that they have reviewed the allegations but found no evidence of compromised individual filmmaker accounts or the specific documents claimed to have been leaked. Despite this, the board is currently conducting a formal security audit in collaboration with the Indian Computer Emergency Response Team and cybercrime authorities. As the industry awaits a comprehensive report, questions persist regarding how many users managed to download the files and the potential for fabricated records within the exposed data set.