MeitY Opens Probe as eMudhra Breach Impact Stays Limited

One of eMudhra’s eight private keys was reportedly the number 4. On Wednesday, India’s Ministry of Electronics and Information Technology, or MeitY, said it had formed a special team to investigate the security incident. It called the impact on Indian websites and apps very limited. The ministry also warned against social media claims it called fear-mongering. ^1,6

MeitY said the special team is examining a flaw in eMudhra’s global certificate business, not its Indian Digital Signature Certificate and eSign services. Those domestic services, regulated by the Controller of Certifying Authorities, remain unaffected. The breach concerns eight intermediate certificates, which link a trusted authority to website certificates and help browsers check that sites are genuine. A researcher raised the alarm on October 17, and CERT-In issued an advisory. ^3,9

According to reports on the company’s explanation, those eight certificates had private keys made with far too little randomness during a key-generation process in April 2025. Six were for website security and two for software signing. Anyone holding the keys could potentially create fake certificates and impersonate websites, though sources report no confirmed misuse. Google, Mozilla and other technology companies moved to block affected certificates. Older devices that miss updates may be harder to protect, while sites using affected certificates may need replacements. ^5,11,15

Those browser blocks are part of a wider clean-up. eMudhra said the affected global TLS business accounts for about 1% of its revenue and that it was working with customers on replacements. The company said its core systems were intact and no data breach occurred. MeitY said the international business operates under a global trust framework and that it is not involved in auditing it. The special team will now investigate the incident; officials said they would share more details after it is complete. ^4,6,7