eMudhra breach: IT ministry says digital signature & eSign services unaffected, sets up probe team

NEW DELHI: The Ministry of Electronics and Information Technology (MeitY) has said that digital signature certificates and eSign services regulated by the Controller of Certifying Authorities remain unaffected by the security incident involving eMudhra.The ministry said it had taken serious note of the incident and constituted a special team to investigate the matter. It also cautioned against social media accounts spreading fear about the incident's impact.The incident relates to the compromise of private keys associated with digital certificates issued by eMudhra, according to an advisory from the Indian Computer Emergency Response Team (CERT-In), the government's cybersecurity watchdog.The IT Ministry said the reported security incident concerned eMudhra's global certificate business and that the impact on Indian websites was expected to be "very limited".Government sources said eMudhra operates separate Indian services, including eSign, and a global certificate business, adding that the issue arose in its global operations. "We are taking it up with them, and we are also taking it up with other operators to check whether they have further issues," a source said, as cited by PTI.In its advisory, CERT-In said eMudhra had reported a compromise of private keys associated with eight intermediate Certification Authority (CA) certificates in its public key infrastructure (PKI). These comprised six Transport Layer Security (TLS) certificates and two code-signing certificates.Digital certificates establish trust in online assets, while TLS protocols help secure data transmission between browsers, applications and websites. Private and public keys are used in encryption and other security processes to protect digital communications.CERT-In warned that the compromised keys could be exploited by cybercriminals to issue fraudulent certificates for domains they do not control. Such TLS certificates could be used to impersonate legitimate websites and facilitate man-in-the-middle (MitM) attacks, potentially allowing attackers to intercept or modify encrypted communications. The compromised code-signing keys could also be used to issue fraudulent code-signing certificates.eMudhra said the incident had no connection with its Indian Digital Signature Certificate (DSC) and eSign businesses and affected only a small part of its global TLS business. The company added that its infrastructure had not been compromised, no data had been breached, and its physical and logical security controls remained intact.According to eMudhra, a flaw in its system led to the creation of weak keys alongside the original strong keys. A researcher had alerted Apple, Google, Microsoft and Mozilla that the weak keys could potentially be reverse-engineered using AI-assisted techniques.The company said its affected global TLS business accounted for around 1 per cent of its revenue, although the incident could pose reputational risks that could not be quantified."eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation," eMudhra said.CERT-In said Google had blocked the public keys of the affected TLS intermediate certificates in Chrome through a Certificate Revocation List Set (CRLSet) update. Google has also announced the removal of eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store. The change is scheduled to be rolled out to all devices relying on the Chrome Root Store on October 27, 2026.Mozilla has also blocked the six affected TLS intermediate certificates issued by eMudhra.Founded in 2008, eMudhra is a Bengaluru-based digital trust and cybersecurity company headquartered at Hi-Tech Defence and Aerospace Park in Jala Hobli, Karnataka.It provides digital trust and cybersecurity solutions for businesses, including Public Key Infrastructure (PKI), digital signatures, SSL/TLS certificates, identity and access management, multi-factor authentication, document signing and digital workflow platforms.The incident comes as the State Bank of India (SBI) disclosed the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web. The bank reportedly received alerts about the suspected exposure from its threat intelligence service provider on October 16.You use AI every day. Now get your AI Quotient. Take the AIQ test.