New Delhi: The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the security incident involving Bengaluru-based eMudhra Ltd, senior officials in the ministry said on Wednesday.
“MeitY has taken serious note of the reported incident. A special team has been constituted to investigate the matter,” the officials said.
The officials said some social media accounts were “indulging in fear mongering about the impact of this incident”, and set out what they described as the facts of the case.
According to the officials, eMudhra operates in two areas. The first is the issuance of Digital Signature Certificates (DSCs) and eSign services, which are regulated by the Controller of Certifying Authorities (CCA) under MeitY. These are used in India to sign documents, tax returns and online filings.
The second area is the issuance of digital certificates that are trusted by browsers and operating systems and used to secure websites, software and online communications. The officials said this function “is international in nature and operates under global trust framework”, and is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.
“The reported security incident pertains to this (digital certificates). MeitY is not involved in its audit,” the officials said.
They said the impact on Indian websites and applications “has been very limited and for a very short period”, and that DSC and eSign services regulated by the CCA remain “completely unaffected by this incident”.
“MeitY remains engaged with all the stakeholders to resolve this incident at the earliest,” the officials said, adding that further details will be shared after the investigation is completed.
The Indian Computer Emergency Response Team (CERT-In), the government’s cyber security agency, issued an advisory Wednesday on the incident, setting out measures for government departments, companies and website administrators to protect their systems.
The incident came to light on 17 October, when a security researcher reported to Google, Apple, Microsoft, Mozilla and eMudhra that the private keys behind eight of eMudhra’s intermediate certificates could be worked out by anyone. A private key is the secret, randomly generated numbers and letters used to decrypt data, sign digital messages, giving a certificate its authority. Anyone holding one of these keys can issue fake certificates for websites and use them to impersonate those sites.
Google and Mozilla blocked the certificates within hours. Mozilla has since removed eMudhra’s root certificate from its trusted list, and Google will do the same in Chrome. Google has said it is also reviewing whether eMudhra’s remaining root certificate should stay trusted.
eMudhra has attributed the flaw to an error in a script used at a key generation ceremony in April 2025, and said its systems were not breached and no data was lost. In its filing to the stock exchanges, the company said the affected business accounts for about 1 percent of its revenue.
eMudhra shares fell 20 percent to the lower circuit of Rs 432 on the National Stock Exchange Wednesday.
(Edited by Viny Mishra)
Also read: What’s the eMudhra security scare that has rattled the internet? All you need to know