Scripts, censor cut lists and distribution contracts for more than five hundred films went up on the Internet Archive, sat there downloadable for days, and were taken down on 12 October. At least three of the distribution agreements had their licensing fees visible, because somebody redacted them badly or not at all.
The story was broken by The Hindu on 25 October and picked up by ThePrint and MediaNama. The documents appear to have come from e-Cinepramaan, the Central Board of Film Certification’s online application portal, and cover December 2025 to August 2026. The films themselves did not leak. Everything filmmakers have to hand over to get a film released did.
Whoever uploaded it used the name of former CBFC chairman Prasoon Joshi, written in Russian, as a username. That account has since been deleted.
Three separate scandals wearing one coat
The commercial one. A distribution agreement is the most commercially sensitive document a producer signs. It sets what a territory paid, which fixes the floor for every negotiation after it. Three of them are now in circulation with the numbers readable. A Delhi commercial lawyer, Abhinav Hansaraman, put it to The Hindu about as plainly as it can be put: “If I am a competing party or a counterparty, I’d be in a much better position to negotiate now.”
That is not a privacy problem. That is a transfer of money from producers to the people on the other side of their next deal, and it is permanent, because you cannot un-know a number.
The intellectual property one. Shooting scripts leaked with shot-by-shot translations and annotations attached. Two of the titles named in the reporting are foreign, the Brazilian film The Secret Agent and the Hollywood release Good Luck, Have Fun, Don’t Die. An international producer has now learned that submitting a film for Indian certification means handing the script to a government portal from which it may end up on a public file-sharing site.
And the one nobody is leading on. The leak included summaries of CBFC-mandated cuts. Per The Hindu’s reporting, those summaries are supposed to be public already, under Section 5A(2) of the Cinematograph Act, 1952. They were not public. The page that should have carried them had been showing an “under maintenance” message.
Sit with that one
The record of what the Indian state cuts out of films is, by statute, a public record. For some period of time it was not available, because the website said it was being fixed. It took a data breach for anyone outside the process to see it.
We have spent six weeks on this site arguing that film certification in India has become harder to see, not softer. The Paradise got an ‘A’. The Vvaan and Drishyam went through with zero cuts. And then Maatrubhumi, the Salman Khan Galwan film, reportedly cleared an Information and Broadcasting Ministry no-objection route for a heavily revised version while its CBFC screening was still pending. Our argument was that the cutting had moved upstream to places with no published record.
This is the same argument with documents attached. The one part of the process that is legally required to be visible was switched off, and the public got it anyway, from a stranger on the Internet Archive using a dead chairman’s name in Cyrillic.
What the CBFC has said
The office of chairperson Shashi Shekhar Vempati says it has found “no trace” of the documents that were claimed to have been accessed. It has filed a complaint with cybercrime authorities, notified CERT-In, had its technical team analyse servers and databases, and committed to a security audit. A forensic examination is ongoing.
Every one of those steps is correct and we are not going to pretend otherwise. But read the sentence carefully, because it is doing two jobs. “No trace has been found” of the documents having been accessed is a statement about the CBFC’s own logs. It is not a statement that the documents are not real, and nobody at the CBFC has said they are not real. Those are different claims and only one of them has been made.
The honest position right now is that a large set of documents matching CBFC submissions was published, the CBFC cannot see how it left, and the investigation is unfinished. We will report the forensic finding when it exists rather than treating either side’s framing as settled.
Bengaluru Baath Take
Indian cinema spent this month arguing about whether Jailer 2 made seven hundred and fifteen crore or seven hundred and thirty three. Meanwhile the body that decides whether any of these films can be shown at all lost five hundred scripts and a stack of contracts, and it ran roughly a fiftieth of the coverage.
Here is the thing producers should be angriest about. Certification is not optional. You cannot release a film in India without submitting to it, which means you cannot refuse to hand over the script and the paperwork. The state compels the disclosure, so the state owns the duty to secure it. A breach here is not bad luck, it is a failure of a service nobody was allowed to decline.
Two things would fix most of this and neither needs a new law. Stop requiring full distribution agreements where a certified extract of the relevant clauses would do, because the licensing fee is nobody’s business at the certification stage. And turn the cut register back on, permanently, in public, as the Act already requires. If the list of cuts is going to end up on the internet either way, it may as well arrive from the CBFC with its own name on it.
We will keep asking for the forensic result. Watch what gets published, not what gets promised.
Sources
- ThePrint: CBFC data breach, scripts, censor cuts and film distribution
- MediaNama: CBFC data breach, censor cuts and distribution agreements
Originally reported by The Hindu. Neither outlet cited above has independently reviewed the leaked documents, and MediaNama says so explicitly. We have not reviewed them either.
