Tata Hack Leaks 200K+ Apple/Tesla Files; 630 GB Exposed on Dark Web

For cybersecurity practitioners, the Tata Electronics breach is a textbook example of supply chain compromise with devastating consequences. A single contractor's vulnerability opened the door to trade secrets of two tech giants — Apple and Tesla — and exposed detailed manufacturing data from factory floor to design blueprint. The fact that data remained available on the dark web for weeks after detection exposes gaps in incident response and takedown coordination, while the diversity of exfiltrated data (OT documents, HR records) signals an advanced lateral movement technique.

The cybersecurity incident at Tata Electronics represents a severe escalation in supply chain attacks against the global electronics manufacturing ecosystem. A ransomware group calling itself World Leaks breached the Indian conglomerate's systems and published over 200,000 files — approximately 630 gigabytes — on the dark web. The data allegedly contains trade secrets from two of the world's most valuable companies: Apple and Tesla. The breach exposes not only the fragility of manufacturing OT/IT perimeters but also the profound cascading risk that a single contractor can pose to multiple multinational corporations.

“

A ransomware group calling itself World Leaks breached the Indian conglomerate's systems and published over 200,000 files — approximately 630 gigabytes — on the dark web.

Tata Electronics has rapidly grown into one of Apple's most critical manufacturing partners outside China, assembling roughly one-third of iPhones produced in India. It also supplies Tesla with components, as evidenced by leaked drawings marked 'TRADE SECRET' for Project Highland — the internal codename for the redesigned Model 3 — and documents referencing an 'NV36 Chargeport Controller,' likely tied to an upgraded Model Y. The leaked Apple files include material specifications, proprietary 'com.apple.factorydata' folders, and a 52-page quality inspection document for iPhone circuit board components, directly from Tata's Hosur plant in Tamil Nadu. This level of detail provides competitors and malicious actors with an intimate view of Apple's tightly guarded manufacturing processes.

The incident highlights a growing trend: nation-state and cybercriminal groups are increasingly targeting suppliers rather than the headquarters of major brands, exploiting weaker defenses in the supply chain. For Apple, which has been diversifying production away from China due to geopolitical tensions, the breach is a setback, casting doubt on the security maturity of its Indian manufacturing base. The fact that the data has been accessible since at least June 10, 2026 — nearly two weeks before public disclosure — raises concerns about detection and disclosure delays. Tata Electronics stated it detected the incident 'a few weeks ago' and immediately activated response protocols, yet the data remained online, indicating either a slow takedown process or a lack of threat intelligence coordination.

World Leaks has not been previously profiled in major threat intelligence feeds, making this a potential debut or rebranding of an existing ransomware operation. The group's decision to leak the data rather than merely encrypt it for extortion suggests an intrusion focused on exfiltration and public pressure. Ransom demands were reportedly made, but no payment details have emerged. The inclusion of employee emails, system logs, and even passport copies points to broad lateral movement within Tata’s network. This indicates that the attackers likely compromised both operational technology (OT) environments — accessing factory floor documents — and IT systems holding HR data. Such dual compromise is a nightmare scenario for manufacturing cybersecurity.