Where did the security lapse at eMudhra occur? Is your data not even safe under the government's watch?

The security breach at eMudhra has raised questions regarding data security and privacy within the 'Digital India' initiative. Amidst warnings from tech entities like CERT-In, Google, and Mozilla, concerns are mounting: is citizens' sensitive data truly secure within the government’s digital infrastructure? Furthermore, what rigorous security audits are required to maintain digital trust?

From SBI to eMudhra, the issue is not merely about data leaks; it is about trust in a system that—while perhaps not explicitly forced upon us—is being actively promoted by the government. The government encourages us to conduct all our affairs digitally: banking, documentation, identity verification, and accessing government services—all must be navigated through digital systems. 'Digital India' is presented as a cornerstone of the nation's development and a hallmark of a modern India.

Yet, a critical question often goes unaddressed: as the government urges us to entrust our data to these digital systems, are the systems themselves—and the data they hold—sufficiently secure?

Recently, reports emerged that information belonging to SBI customers had allegedly been leaked on the dark web. Now, the incident involving eMudhra has raised further, serious concerns regarding digital security. While the cases of SBI and eMudhra differ, both force us to consider a troubling reality: if the government struggles to manage its own data, how can the data of ordinary citizens—who rely on these digital systems—ever be truly secure?

First, let’s understand: what does eMudhra actually do?

eMudhra is no ordinary tech company. It provides services such as digital signatures, electronic signing, and digital certificates. In simpler terms, when you need to digitally sign a government or business document, a digital signature certificate serves to verify your identity. Similarly, when you open a website, your browser uses its digital certificate to verify whether it is connecting to the legitimate website.

In other words, such certificates play a crucial role in determining whom to trust in the digital world. A part of eMudhra’s business involves issuing these certificates for websites and software—certificates that are trusted by browsers and operating systems worldwide. Now, consider how serious the situation could become if a major flaw were to emerge within this very system.

What happened at eMudhra that caused such a significant issue?

On October 21, 2026, CERT-In issued an advisory regarding a security vulnerability linked to eight of eMudhra’s intermediate Certificate Authority (CA) certificates. Let’s break this down into simpler terms.

When a website proves its authenticity, its digital certificate is verified. Within this entire framework, there are certain entities whose certificates are trusted by other systems; these are known as Certificate Authorities (CAs). Associated with these certificates is a "private key"—think of it as a secret key used to authenticate a digital identity. Keeping this key secure is absolutely critical.

In the case of eMudhra, a technical error occurred during the creation of the private keys for these eight certificates, rendering them insecure and easily guessable. According to reports, one of these keys had a value of just 4, and the others were also below 256. To put it in perspective: if the key to a lock is so simple that anyone could open it in just a few attempts, what is the point of having the lock at all? This was the most serious aspect of the situation. These keys could have been identified almost instantly by leveraging publicly available information and AI.

What kind of risk could this have posed? If a cyber hacker were to obtain such a private key, they could potentially use it to create fraudulent digital certificates. This could result in a fake website appearing identical to a legitimate one—to the extent that, under certain circumstances, even a web browser might mistake it for the real site. In such a scenario, the hacker could also intercept network traffic, causing harm to the user.

There is also the risk that keys associated with software certificates could be misused to make malicious software appear trustworthy. In other words, this was not merely a technical glitch within a single company’s systems; it was a flaw in the very framework relied upon to verify the authenticity of websites and software across the internet. That said, based on the information currently available, there is no evidence of widespread damage.

Yet, a fundamental question remains: how did such a critical security vulnerability go undetected for so long?

How could such a major oversight occur, despite two years of audits?

The most pressing question in this case concerns security audits. According to reports, the international operations of eMudhra had undergone independent audits. Despite this, a serious weakness in the process of generating private keys was exposed. In its initial explanation, the company stated that a procedural error led to the creation of a set of "weak" keys alongside the valid ones. Because the two sets had similar names, the incorrect (weak) keys were inadvertently used. However, the issue extends beyond the company’s own explanation.

When a system’s security is being audited, is it also verified whether cryptographic keys are being generated correctly? Did the auditors thoroughly examine this process? And if an audit was conducted, why was such a significant error not detected?

Answers to these questions are essential. An audit should not merely be a “tick-box” exercise; its very purpose is to ensure that such errors are identified in time, before they escalate into major threats.

Reports also raise questions about security audits

Following the discovery of a security flaw at eMudhra, questions are being raised as to why such a major error went unnoticed during security audits. In a report published on October 22, 2026, the Internet Freedom Foundation (IFF) raised concerns regarding the company’s security infrastructure, auditing processes, and government oversight. The organization has demanded that eMudhra, CERT-In, and MeitY conduct a detailed investigation into the matter and make the findings public.

Meanwhile, in a report released on October 20, Google revealed that a serious security lapse occurred during the generation of private keys for eight of eMudhra’s digital certificates. These keys lacked sufficient strength and security, making them easily discoverable. If an unauthorized party were to obtain such a key, they could potentially misuse it to issue fraudulent digital certificates. In certain scenarios, this could be exploited to make a malicious website appear legitimate or to compromise information transmitted over the internet.

Where does the government’s responsibility begin?

This brings us to the most critical question—one directed at the government.

eMudhra’s Indian digital signature and eSign services are overseen by the Controller of Certifying Authorities, which operates under the Ministry of Electronics and Information Technology (MeitY). However, the incident in question pertains to the company’s international website certificate business. CERT-In has clarified that India’s domestic digital signature and eSign services remain unaffected by this incident.

It is important to understand this distinction. This does not mean that every digital service in India was at risk. However, questions regarding the government’s responsibility inevitably arise. As the use of digital services expands across the country, how effective is the oversight regarding the security of these services and their underlying infrastructure?

Are security standard audits conducted merely to fulfill regulatory requirements, or are they genuinely aimed at identifying system vulnerabilities? When a major flaw is discovered in a company’s system, what steps will be taken to determine its root cause and prevent such errors in the future? Most importantly, will the findings of any investigation be made transparently available to the public?

The government has formed a special team to investigate this matter. CERT-In has issued an advisory, and browser developers like Google and Mozilla have blocked the affected certificates. However, taking action after a problem arises is fundamentally different from having systems in place to prevent such issues from occurring in the first place.

The actions taken by Google and Mozilla make the question even more pertinent.

In this instance, Google and Mozilla blocked the compromised certificates, which helped mitigate risks for browsers that rely on their security updates and certificate-revocation mechanisms. While it is commendable that security researchers and browser developers identified the issue and took action, it raises a broader question: should action only be taken after a major vulnerability is discovered in such a critical component of digital security? Shouldn’t there be mechanisms in place to detect such errors proactively?

It is entirely appropriate to question the government here. While the government may not be directly liable for every technical error made by a private company, it bears a crucial responsibility to establish security regulations, oversee compliance, and ensure accountability following serious incidents. This responsibility cannot be overlooked when discussing ‘Digital India.’

‘Digital India’ requires not just internet access, but also security.

The debate is not about whether or not digital services should be expanded. Online banking, digital signatures, and government services offer convenience to the public. However, security is just as essential as convenience. If the government encourages citizens to integrate their documents and tasks into digital systems, it must also ensure that robust security protocols are in place, thorough audits are conducted, and that the public is promptly and accurately informed should any major vulnerability or breach occur.

In the case of eMudhra, it has not been established that the personal data of Indian citizens was stolen on a large scale. According to the company and CERT-In, India’s domestic eSign and digital signature services remained unaffected by this incident. Nevertheless, this does not mean that all questions have been answered. While it is necessary to raise questions following a security incident, it is even more critical to understand why such a lapse occurred in the first place and who was responsible for preventing it.

‘Digital India’ should not merely be a collection of apps, websites, and online services. It must also encompass a digital ecosystem that people can trust—one where, in the event of a significant failure, the responsible entities can be held accountable. After all, when the government expects its citizens to embrace digital platforms, those citizens have every right to expect that their security will be treated with the utmost seriousness.