Ransomware Group World Leaks Posts 200,000 Tata Electronics Files Tied to Apple and Tesla Supply Chains

What Tata Confirmed and What It Won't Say Tata Electronics confirmed to Reuters and TechCrunch on June 22 that it detected a cybersecurity incident "a few weeks ago" and deployed response protocols. Its full public statement: "The incident has had no impact on our operations across businesses, which remain unaffected." That is the entirety of what the company has said on the record. Tata declined to answer questions about the nature of the compromised data, how many individuals or organizations were affected, whether clients had been notified, or whether a ransom was paid. The Indian Computer Emergency Response Team, a unit under India's IT ministry that handles cyber incidents, had not responded to Reuters requests for comment as of June 22.

What the Hackers Are Claiming World Leaks, the

group taking credit, posted what it says is stolen Tata data on the dark web. Security researchers told Reuters the cache has been accessible on the dark web since at least June 10. The files reportedly include engineering drawings, product specifications, quality standards, internal email logs, and copies of employee passports. Cybersecurity researcher Rajshekhar Rajaharia told TechCrunch that the dataset includes Outlook email conversations, SAP system data, and documents appearing to link to Apple factory operations and Tesla parts supply chains. Specifically, documents tied to Tesla reportedly concern components for a refreshed Model 3, according to Business Today. TechCrunch reviewed a sample of the files and found what appeared to be Apple supplier specifications and Tesla manufacturing documents. Reuters also said it could not immediately verify the data.

Who Is World Leaks World

Leaks emerged in early 2025 as a rebranded version of the Hunters International ransomware operation, according to Business Today. The group has shifted strategy away from encrypting victim systems toward pure data exfiltration: steal the data, post it publicly, and demand payment to stop the exposure. World Leaks has previously claimed responsibility for a breach at Nike.

Apple Investigating, Ransom Demand Confirmed

A source familiar with the matter told Reuters that Apple is actively investigating and "a full analysis was going on." Reuters also reported, citing the same source, that Tata Electronics received a ransom demand related to the incident. Tata declined to comment on the ransom. Apple did not respond to comment requests from Reuters, TechCrunch, or India Today. Reuters separately reported that Tata Electronics informed some employees at its iPhone assembly operations about the breach last week.

Why This Supplier Matters Tata Electronics is not a

peripheral vendor. The company entered iPhone manufacturing in 2023 by acquiring the Indian operations of Wistron, a longtime Apple contract manufacturer. It later acquired a 60% stake in the Indian unit of Pegatron, another major Apple assembly partner. In 2024, Tata signed a semiconductor supply deal with Tesla. As of June 22, Tata Electronics employs more than 75,000 people across Indian facilities and holds partnerships with Apple, ASML, Intel, Qualcomm, and Tesla, according to its parent company's website. Its expansion is central to Prime Minister Narendra Modi's push to establish India as an electronics manufacturing hub and to Apple's strategy of diversifying production beyond China.

The Strongest Counterargument

Operations Unaffected Is a Real Distinction Tata's repeated claim that operations remain unaffected deserves fair hearing. There is a meaningful difference between a data exfiltration event and a destructive attack that halts production. Tata's systems appear to be running. No assembly lines are reported down. No product shipments have been flagged as disrupted. Leaked documents, even sensitive ones, do not automatically translate into compromised manufacturing, product defects, or consumer harm. The company's response protocols were activated, and on the operational side, the evidence supports their claim. That said, the distinction narrows when the exposed data is proprietary engineering specifications. Competitors or state actors accessing detailed Apple manufacturing tolerances or Tesla component designs for the Model 3 refresh represents a different category of damage than a payroll database leak. The harm is competitive and strategic, not immediately operational. Tata's British Jaguar Land Rover group was hit by a cyberattack last year that caused a six-week production halt, according to India Today. That history is relevant when assessing how seriously to take "operations unaffected" assurances at the early stages of an investigation.

The Open Question Nobody Can Answer

Yet The files have reportedly been on the dark web since June 10. Twelve days have passed. Tata has not disclosed which specific customer data was exposed, has not confirmed whether Apple or Tesla were directly notified, and has not said whether any third party has independently audited the breach scope. What actually sat in those 630GB of files, and whether anything in them is materially useful to a nation-state competitor or a rival manufacturer, is the question that neither Tata, Apple, nor any regulator has answered publicly as of June 22, 2026.