eMudhra, an Indian digital certification authority, has revealed that eight private keys associated with its certificates have been compromised. The shocking disclosure about eMudhra, whose digital certificates help browsers confirm that a website is genuine, came after an advisory from the cybersecurity watchdog CERT-In (Indian Computer Emergency Response Team).

The Bengaluru-headquartered eMudhra is a licensed Certifying Authority (CA) that issues Digital Signature Certificates (DSC) under the Indian IT Act, as per a The Hindu Businessline report.

Several government websites use a range of eMudhra’s keys to “sign” their security certificates, which is necessary for any website to display on a modern browser.

IT firm 3i Infotech launched eMudhra, an initiative to roll out digital signatures for retail customers at an affordable price, in November 2008. It became India’s very first eSign Service Provider in 2015, as per the company website, which also stated that it had issued over 60 million certificates by 2022-23. 

Some of its customers include Infosys, TCS, Bharti AXA Life Insurance Company, Larsen & Toubro Infotech, and Hindalco Industries. The ₹412.80-crore IPO of eMudhra was subscribed 2.72 times. Ahead of the issue in May 2022, the company garnered ₹123.83 crore from the anchor investors, The Hindu Businessline had reported.

Many government websites, including the Aadhaar issuer UIDAI and the income tax filing portal, use eMudhra certificates or other technology from the firm. eMudhra is the only Indian root certificate authority trusted globally.

After the breach was reported, the IT ministry said eMudhra operates in two distinct areas. The first is the issuance of Digital Signature Certificates and eSign services, which are regulated by the Controller of Certifying Authorities (CCA), and the second is the issuance of digital certificates trusted by major browsers and operating systems, used to secure websites, software and online communications.

eMudhra has claimed that its infrastructure was not compromised, no data was breached, and all physical and logical security controls of the firm remained intact, news agency PTI has reported.

The Ministry of Electronics and Information Technology (MeitY) also released a statement, stating that the impact on Indian sites and applications are “very limited”. It stressed that Digital Signature Certificates and eSign services regulated by the CCA remain completely unaffected.

The Ministry has also constituted a special team to investigate the security incident at eMudhra.

Shares of eMudhra plunged nearly 20 per cent to a 52-week low on Thursday (October 22, 2026), after the government said it has constituted a special team to probe the security incident. The digital authentication services company has also announced its decision to exit from the SSL and TSL certification business after a vulnerability was discovered in the security keys issued by certification authorities under it.

Even as the eMudhra breach made headlines, another incident linked to the State Bank of India (SBI) also surfaced on October 21, 2026. India’s largest commercial bank, SBI said it is investigating the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web.

(With inputs from PTI)