What eMudhra security incident means for anyone who shops, banks or pays online

Oct 22, 2026

Synopsis
The eMudhra security incident raised concerns that cybercriminals could potentially use weak private keys to create fake website certificates and impersonate legitimate platforms. Here’s how such an attack could put users’ personal and payment details at risk, and what is known about the incident so far.

Imagine you get a message asking you to pay a bill online. You click the link, the website looks genuine, and your browser shows a secure connection. So, you go ahead and enter your details. But what if something is wrong with the system that helps your browser check whether a website is real or fake? That’s the concern behind the eMudhra security incident. Eight digital certificates linked to the Indian company’s global website-security business were found to have extremely weak private keys. This raised concerns that cybercriminals could potentially use them to create fake websites that look genuine and trick browsers into trusting them.

Google, Mozilla, Apple and Microsoft were alerted to the issue, and browser companies moved to block the affected certificates. However, eMudhra says the certificates had not been used to issue customer certificates, its infrastructure was not compromised, and no data breach occurred.

The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the incident. The ministry has also clarified that India's regulated digital signature certificate and eSign services remain unaffected.

So, what exactly went wrong, how could these weak keys have been misused, and should smartphone and internet users be worried? Here is a simple explanation.

What is eMudhra, and what does the company do?

eMudhra is a Bengaluru-based Indian digital identity and cybersecurity company that provides digital signature services, electronic authentication and security certificates. Its services help individuals and organisations sign documents electronically, verify identities and secure online communications. The company also operates a global website-security business under the emSign brand.

To understand the latest incident, it is important to distinguish between two parts of eMudhra's operations.

Digital signature and eSign services in India: These help people and businesses sign documents electronically and verify identities.

Global website-security certificates: These help browsers establish whether a website's identity can be trusted and enable secure connections between websites and visitors.

The recent incident concerns the second area. MeitY has clarified that eMudhra's regulated Indian digital signature and eSign services remain unaffected.

What are digital certificates, and why do websites need them?

Whenever you visit a website that uses HTTPS, your browser checks its digital certificate to help verify the website's identity and establish a secure connection.

Think of a digital certificate as an identity card for a website. It contains information that helps establish which website it belongs to and is linked to cryptographic keys used in the security process.

Companies known as Certificate Authorities (CAs) issue these certificates. Browsers maintain lists of trusted authorities whose certificates can be accepted under their security rules.

eMudhra is one such authority. Its certificates are part of the wider system that browsers use to establish trust online.

However, this system depends on the security of the certificates and keys involved. If a certificate authority creates a weak key, it could undermine the trust that browsers place in the certificates issued through that system.

What happened in the eMudhra security incident?

The issue came to light on October 17, 2026, when a security researcher alerted Google and other technology companies to vulnerabilities involving eight intermediate certificates issued by eMudhra. According to the information released about the incident, six of the certificates were intended for website security and two for software signing.

The problem was with the private keys associated with these certificates. Such keys should be generated using sufficiently random values that are extremely difficult to guess or recover.

Instead, the affected keys were so weak that researchers could work them out almost instantly.

The discovery did not mean that hackers had stolen the keys from eMudhra's systems. Rather, the keys were so poorly generated that they could be recovered using information that was already public.

What are private keys, and how were these keys so weak?

Private keys are secret digital values used in cryptographic systems. Depending on the system, they can help authenticate identities, establish secure connections or authorise digital signatures. In the eMudhra incident, the concern was about keys associated with certificates that help browsers establish trust in websites.

For a P-384 elliptic-curve private key, the expected security depends on an enormous mathematical range of possible values. The affected keys, however, reportedly had only three to eight bits of entropy, a measure of unpredictability.

In simple terms, imagine trying to guess a password. A long, randomly generated password could take an impractical amount of time to crack. But if the password were one of only a few possible numbers, someone could try every option almost immediately.

That is broadly what happened here. According to the reported findings, the affected keys included extremely small values such as 4, 56, 66, 115, 155, 156, 230 and 237.

The weakness meant that someone did not necessarily need to steal the keys. They could potentially work them out from publicly available certificate information.

How could criminals have misused the weak keys?

The main worry was that anyone who managed to recover the affected private keys could potentially create fake certificates for websites pretending to be legitimate platforms.

For example, imagine a criminal creating a fake payment page that looks exactly like your bank’s or a retailer’s website. Normally, your browser checks a website’s digital certificate to help verify that the connection is secure.

But if an attacker could use a compromised certificate authority key to create a fake certificate that the browser trusted, the website could look more convincing. This could also make it harder for the browser to flag the site as suspicious.

A person visiting the fake website might then end up sharing their personal information, login details or payment information without realising something was wrong.

That’s why the incident matters even if you’ve never heard of eMudhra. Digital certificates work behind the scenes to help keep everyday online activities, from shopping and making payments to accessing online services, secure.

However, the possibility of an attack does not mean one actually happened. Based on the information released about the incident, there is no evidence that the weak keys were used in a cyberattack.

How did the weak keys get created?

The precise cause of the flaw is the subject of the investigation, but eMudhra has provided an explanation of what went wrong during the key-generation process.

In an official statement, the company said a flaw in a process carried out on April 30, 2025, resulted in a second set of weak keys being created alongside the intended strong keys.

The company said: "A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores."

In simple terms, the process that was supposed to handle the keys securely generated an additional, weaker set. Those weak keys were then published through the certificate infrastructure trusted by browsers.

The company has said it is investigating the error. As of October 20, 2026, the cause had not been fully established by the investigation.

What has eMudhra said about the incident?

eMudhra has maintained that the incident did not lead to a breach of its infrastructure or customer data.

Speaking to PTI, eMudhra co-founder Kaushik Srinivasan said the affected keys had not been used to issue customer certificates.

"There's no impact to subscribers because we have done all the actions," Srinivasan told PTI.

He added that the company was notifying customers and said the incident did not affect its Indian digital signature business or enterprise solutions.

The company has also said that all eight affected intermediate certificates were revoked on October 19 and that its physical and logical security controls remained intact.

The affected global website-security business accounts for around 1% of eMudhra's revenue, according to Srinivasan. He acknowledged that the incident could carry reputational risks for the company.

What action have Google, Mozilla, Apple and Microsoft taken?

Google blocked the affected public keys in Chrome through a Certificate Revocation List Set update. It also announced the removal of eMudhra's emSign ECC Root CA-G3 certificate from the Chrome Root Store, with the removal scheduled to begin on October 27, 2026, according to information released about the incident.

Mozilla blocked the six affected TLS intermediate certificates. Apple and Microsoft were also alerted and took part in the response to the vulnerability.

These actions are intended to prevent browsers and other software from continuing to trust the affected certificates. They are part of the effort to reduce the possibility that the weak keys could be used to make fraudulent websites appear legitimate.

Are Indian websites, government portals and eSign services affected?

MeitY has said the impact on Indian websites and applications was limited and lasted for a short period. The ministry has also clarified that eMudhra's Indian Digital Signature Certificate (DSC) and eSign services, which are regulated by the Controller of Certifying Authorities under MeitY, remain unaffected.

The Indian Computer Emergency Response Team (CERT-In) has issued an advisory outlining mitigation measures, while MeitY has constituted a special team to investigate the incident.

What should smartphone and internet users do?

► Check website addresses carefully: Look for misspellings or unusual domain names before entering sensitive information.

► Do not rely only on the padlock symbol: HTTPS indicates an encrypted connection, but it does not guarantee that a website or the person operating it is trustworthy.

► Avoid suspicious links: Be cautious about payment links received through unsolicited messages, emails or social media.

► Never share OTPs or passwords: A website that looks genuine can still be part of a scam.

► Keep your browser updated: Updates help ensure that security changes and protections are applied.

These precautions are useful regardless of whether a particular user has been exposed to this incident.

What happens next in the eMudhra investigation?

The government-appointed team will investigate the incident, including how the weak keys were generated and how they entered the certificate infrastructure trusted by browsers. eMudhra says the affected certificates have been revoked, while technology companies have taken steps to block them. The company has also maintained that its infrastructure was not compromised and that no data breach occurred.

[The Economic Times]