- The Hindu reports that files tied to applications for more than 500 titles, filed with India's film censor board, were downloadable from the Internet Archive for days.
- At least three agreements showed licensing fees, and lawyers told The Hindu this could weaken negotiating positions. The board says it has found no trace of the documents so far.
- How the files left the portal, or whether they did, is unknown. Ask regulators how long they keep your filings, who can reach them, and who would notice a leak.
When a filing leaves your hands
Filing a contract with a regulator feels like paperwork. It is also a handover. From then on, someone else decides how long the copy is kept and who can open it. A report in The Hindu shows why that matters, even though key facts are still disputed.
To certify a film for Indian cinemas, producers send the Central Board of Film Certification (CBFC) a bundle of documents. The Hindu reports that files said to come from those filings were publicly downloadable. The board says it has found no trace of the documents.
What The Hindu reports
The paper counted material tied to more than 500 titles. Dozens were feature films. The files included scripts, instructions on cuts and contracts. The films themselves were not among them.
The files sat as datasets on the Internet Archive, a non-profit library site. Anyone could download them. They stayed up for days. Most went up earlier this month, and all were gone by October 12. The file dates run from December 2025 into August 2026.
The uploader used a Russian-language display name matching that of former CBFC chairman Prasoon Joshi. The account was later deleted. The Hindu could not reach the user. The Internet Archive told the paper that the user took the account down.
The Hindu says the files seem to trace back to e-Cinepramaan, the board's online filing system, which is almost ten years old. The paper also notes that the portal was down for hours on October 4. It adds that the uploader stopped posting soon afterwards. The source does not say these two events are linked.
What the board says
The CBFC says it is looking into the matter. Its statement says that, on the information examined so far, "no trace has been found of the certification-related documents that were claimed to have been accessed."
The board says it filed a complaint with cybercrime authorities and told India's national computer emergency team, CERT-In. It says its technical staff checked servers and databases for outside attacks. A forensic examination continues. The board also promised a "thorough security audit" of the portal.
The two accounts do not match yet. The Hindu found files that people could download. The board has not found them in its own systems. The public reporting does not say how the files left the portal, or whether they did.
What the contracts showed
The Hindu identified local distribution agreements for films including the Brazilian Oscar nominee "The Secret Agent" and the Hollywood film "Good Luck, Have Fun, Don't Die". At least three of the agreements showed licensing fees.
Lawyers who reviewed excerpts spoke to The Hindu. Vasundhara S. of Verum Legal said that when specially negotiated terms enter the public domain, the confidentiality behind them is compromised. She said this can weaken negotiating positions.
Delhi commercial lawyer Abhinav Hansaraman made the same point more bluntly. A counterparty who knows what terms a party has accepted before would be "in a much better position to negotiate".
That is the commercial risk. The lawyers quoted in the report focused on the contracts. A password was not the loss they described. The loss is a negotiating position.
How could files travel from a portal to an archive?
Nobody has said. The board told The Hindu that no filmmaker's account appeared to be compromised. It has not described what its server and database checks found. What follows are questions, not findings.
Did an outsider break into servers or databases? Did someone with legitimate access copy files out? Did a stolen login open the door? The board's reported statement covers filmmaker accounts only. It does not address staff or administrator accounts.
Each route points to a different control. Retention limits shrink what any intruder can take. Access logs show who opened which file. Data minimisation means a portal holds less to begin with. Egress monitoring flags large volumes leaving a system. The reporting does not say whether the portal had any of these.
Questions to put to your team
A confidentiality clause may not stop a leak from a regulator's copy, and it cannot undo one. Start with what you file. List the commercial documents your teams send to regulators and public portals. Ask whether each one needs the full contract or only the relevant terms.
Then ask about custody. Does the operator say how long it keeps documents and who can see them? Do your own agreements let you ask for an audit or an incident notice?
Finally, ask about detection. Who in your organisation would learn that a sensitive document had appeared on a public archive? Here, the board's public response came after a newspaper's query.
A contract is only as private as the system that stays with its copy. The board's forensic work is still open, so how the files reached the archive is not yet known.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Hindu.
