CBFC Data Breach: Filmmakers Raise Alarm, Call for Stronger Cybersecurity

An alleged major data breach involving certification records of over 500 films at the Central Board of Film Certification (CBFC) has raised concerns within the film industry over the security of confidential information submitted by filmmakers. The leak originated from the CBFC’s official e-Cinepramaan portal, an online system launched a decade ago to digitize the movie certification process. The reportedly compromised material includes film scripts, cut orders and distribution agreements, documents that can contain sensitive creative and commercial information.

While the CBFC has maintained that its preliminary examination has found no evidence of the claimed unauthorized access, it has initiated precautionary measures, including a cybercrime complaint, notification to CERT-In and a forensic examination of its systems. The board also maintained that its film certification operations remained completely unaffected.

Related Stories

Sunny Deol’s ‘Suryaa: Ant Se Aarambh Tak’ Awaits CBFC Certification, IMA Demands Ban on Film

‘Clayface’ Certified A in India, CBFC Removes Frontal Nudity and Face-Smashing Scenes

The controversy has triggered varied reactions from filmmakers, actors and former censor board officials. While some have called for stringent cybersecurity safeguards, others believe the industry should avoid panic until the extent of any possible breach is established.

Vani Tripathi Tikoo, former CBFC member: The CBFC should implement multi-factor authentication (MFA), strong passwords, and role-based access controls to ensure that only authorized personnel can access confidential information. It should encrypt sensitive data during storage and transmission and use secure file-sharing platforms. Regular cybersecurity audits, penetration testing, and timely software updates are essential to identify and fix vulnerabilities. The CBFC should also conduct cybersecurity awareness training to help employees recognize phishing emails, suspicious links, and other cyber threats. It should also maintain encrypted, offline backups and regularly test recovery procedures to prevent data loss. A dedicated incident-response team should continuously monitor systems, detect suspicious activities, contain breaches, and notify relevant authorities and affected individuals as required by law.

The CBFC must also strengthen cybersecurity requirements for third-party vendors and cloud service providers. It should also comply with applicable Indian cybersecurity and data-protection requirements, including CERT-In directions and the Digital Personal Data Protection framework. Finally, the CBFC should establish clear accountability, conduct regular security assessments, and organize simulated cyberattacks to test its preparedness. These measures will significantly reduce the risk of future data breaches and improve the security and confidentiality of its digital assets.

Asha Parekh, veteran actress and former CBFC chairperson: During my tenure, nothing like this happened. Such vulnerabilities come with digitization.

Sudhir Mishra, filmmaker: The creative is treated as inconsequential by everyone in the system. We are no longer in control. So what can I say except that they are duty-bound to maintain confidentiality and ensure no one else has access to it.

Prakash Jha, filmmaker: What can one say! We are in the clutches of mobile and social media! Can anything remain private anymore?

Rajkumar Santoshi, filmmaker: What happened is definitely wrong, but filmmakers shouldn’t panic. I believe the responsible agencies will handle the situation properly and take the necessary steps to ensure such incidents don’t happen again. Of course, when confidential information is leaked, it is a matter of concern. But we are all part of one film industry, and we stand together in dealing with such issues.

Vishal, actor-producer, former president of the Tamil Film Producers Council and former general secretary of the South Indian Artistes’ Association: My main concern would be that my film isn’t leaked. To my knowledge, the CBFC does not retain films after certification in a manner that would necessarily make their content accessible through its certification database. But they should have a watertight system in place because hacking has become common. The hacker might have done this just for the thrill of breaching a system rather than for commercial gain.

Vikram Malhotra, Founder & CEO of Abundantia Entertainment: In an increasingly digital ecosystem, data protection needs to be approached with a 360-degree mindset. Multi-layered data security must become the norm, not the exception, with systems and safeguards constantly tested, upgraded and monitored to stay ahead of evolving cyber threats. This is especially critical in our industry, where creative IP and commercially sensitive information are invaluable assets. I am not aware of the full extent of the reported breach or the nature of the compromise, but sincerely hope that confidential information relating to these films and associated material does not fall into the wrong hands. Protecting creative IP and confidential business information is a shared responsibility that demands constant vigilance.

Manish Gupta, writer-director: Our industry needs to tighten its technical departments. Piracy has always been an elephant in the room for us filmmakers. Now, contracts and scripts too are being leaked! The only solution is a strict upgrade of security, safety and privacy protocols. Those responsible for protecting this data from leakage need to be held accountable. Piracy of a film or any material or data related to a film is as much a crime as stealing someone’s money.

Nidhi Dutta, producer: This is deeply disturbing because filmmaking is built on trust — trust that our stories, scripts and commercially sensitive information will remain confidential until we choose to share them with the world. A film is the result of years of creative and financial investment, and any breach of that confidentiality can have serious consequences. It is imperative that the matter be thoroughly investigated, accountability be established, and robust safeguards be put in place to protect filmmakers’ creative and commercial interests.

Krish Jagarlamudi, filmmaker: Cinema, irrespective of language, faces serious problems. This data-breach issue needs to be addressed immediately, and the guilty should be punished.