A ransomware group called World Leaks has posted stolen Tata Electronics files on the dark web, exposing supplier maps, component details, and drop-test photos tied to Apple's unreleased iPhone 18 Pro models.
Sensitive component lists, supplier maps, and photographs of Apple's unreleased iPhone 18 Pro models have surfaced on the dark web after a ransomware group stole more than 200,000 files from Tata Electronics, one of Apple's key Indian manufacturing partners, according to documents reviewed and a person familiar with the matter.
The ransomware group, operating under the name World Leaks, posted the stolen files after breaching Tata Electronics, which both supplies parts to Apple and assembles iPhones as a contract manufacturer. World Leaks has previously claimed responsibility for a separate intrusion at Nike.
At least six files within the leaked cache map hundreds of components in the iPhone 18 Pro models to their specific suppliers — detail that Apple does not disclose in its public supplier database, according to the person familiar with the matter. The records include information about chips on the main circuit board and parts related to the battery and cameras.
The documents also reveal where Apple sources a component from multiple suppliers and where it depends on only a few, exposing both its negotiating leverage and potential supply chain vulnerabilities, the records show.
Apple is reportedly on track to release the iPhone 18 Pro and Pro Max in September. The company considers the supplier-to-part mapping sensitive and is concerned about the documents circulating on the dark web given that they relate to unreleased models, according to the person familiar with the matter.
Several of the leaked files carried Apple "confidential" watermarks and internal code names consistent with the iPhone 18 Pro generation. Among the leaked materials are photographs of iPhones undergoing drop tests at one of Tata's plants, dated early 2026. The images show a grey, slab-shaped handset with a three-rear-camera setup and the Apple logo. The source confirmed the photos depict iPhone 18 Pro models, though the exact model number could not be independently verified.
The data breach was first flagged publicly by news site AppleInsider the previous week. Reuters had earlier reported that the Tata leak included component design papers for older iPhone models and some documents related to Tesla, also a Tata client. Files from Taiwan Semiconductor Manufacturing Co. and Qualcomm — both suppliers of iPhone components — were also included in the earlier-reported tranche.
Apple is investigating the matter and working with Tata on long-term remediation measures, Reuters has previously reported. Tata has restricted internal access to sensitive systems and hired a global consultant to conduct a forensic audit. Spokespeople for Apple and Tata did not respond to queries.
The breach arrives at a complicated moment for Apple. The company last week raised iPad and MacBook prices due to soaring memory and storage chip costs, with analysts expecting iPhone price increases in the coming months.
The exposure also carries strategic implications that extend beyond the immediate product cycle. India accounted for an estimated 26% of global iPhone production in 2026, up from 6% four years earlier, according to research firm Counterpoint — a shift that is central both to Apple's supply chain diversification away from China and to Prime Minister Narendra Modi's effort to establish India as an electronics manufacturing hub. Tata's role as Apple's newest major assembler in the country makes the trust damage from the breach particularly consequential for both parties.
The leak could also provide rivals, counterfeiters, and competing vendors with an unusually detailed view of Apple's supplier relationships — information the company has historically guarded closely. How Apple and Tata respond to shore up data access controls in the months ahead will likely determine whether the partnership can sustain the scale of manufacturing investment both sides have committed to.
TechEchelon Staff bylines are produced collectively by the newsroom for short, breaking, and wire-style coverage. Longer-form reporting is published under the responsible reporter's name.
More from the Staff →Mozilla's Zero Day Investigative Network demonstrated a proof-of-concept attack in which a GitHub repository containing no malicious code can manipulate AI coding agents like Claude Code into executing a remote shell by exploiting automated error-recovery behavior.
Imposter scams topped FTC fraud reports for the fifth year running in 2025, with roughly 1 million reports filed and $3.5 billion in losses — part of a record $15.9 billion in total fraud reported to the agency.
Polish authorities, with FBI and HSI support, arrested four members of a cybercrime ring accused of SIM-swapping attacks that hijacked cryptocurrency exchange accounts and laundered an estimated $5 million or more through accounts across multiple countries.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.