On 21 October, widespread disclosures brought to light a little-known Indian company, Ltd. At its heart were digital ‘certificates’, which the company allegedly left unprotected on the internet—thereby making its users highly susceptible to fraud. Compounding this is the fact that eMudhra is the only Indian issuer of digital certificates trusted by websites worldwide. Mint explains the debacle and what it might mean for the internet in India.
Founded in 2008 by Venkatraman Srinivasan, eMudhra Ltd is a Bengaluru-based company that offers digital identity verification, cybersecurity, paperless work management, and associated services. The company went public on 1 June 2022 in a ₹412.79 crore initial public offering, with 60% of the proceeds from the promoters’ sale of shares. In FY26, it reported ₹701.6 crore in operating revenue and ₹110 crore in net profit.
Srinivasan, the founder and executive chairman, holds 17.3% of the company. Other promoters alongside Srinivasan collectively hold 54.4% of the company. Globally, the company has six international subsidiaries in Mauritius, UAE, US, Singapore, the Netherlands and Indonesia. Some popular services that eMudhra offers include digital signatures for India’s income tax and provident fund forms, trusted identity and multi-step verification within companies, and paperless document verification.
The other side of eMudhra’s business, which certifies whether a website is secure, is the one that was seemingly compromised here.
On 17 October, an independent cybersecurity researcher disclosed on Mozilla’s public, open-source web browser cybersecurity incident tracker that websites using eMudhra’s digital certificates could be compromised.
Put very simply, eMudhra is one of a handful of companies registered on the Ministry of Electronics and Information Technology (MeitY)’s Controller of Certifying Authorities (CCA) list. Interestingly, it is currently the only company from India that is a recognised digital certificate issuer trusted by most web browsers worldwide, including Google Chrome, Microsoft Edge, Apple , and Mozilla’s own Firefox.
The flaw pertained to eMudhra’s digital certificates themselves. One way websites identify themselves as authentic is through digital certificates, which encrypt a website’s information using complex cryptographic keys—a string of 115 characters generated by digital randomness. This ‘key’ is so long and comes in so many permutations and combinations that classical computers could take decades to guess just one.
Instead of such a complicated key, eMudhra’s digital certificates appeared to show keys that were extremely simple and would allow almost anyone with a basic laptop to spoof, guess and then breach. For instance, when users open a banking website, the site uses a mechanism called Transport Layer Security (TLS) to encrypt the user’s data with a certifying authority’s digital keys, preventing cyber attackers from stealing it.
Such an incident, the original cybersecurity report said, revealed a lack of emphasis on security at eMudhra for tasks that could be highly critical and sensitive.
In a statement issued on BSE on 21 October, eMudhra claimed that the weak security keys were generated due to a technical ‘flaw’ and that the company is ‘working to establish the root cause’.
On this note, eMudhra further claimed that it had not experienced any cyber breach and remained in full control of its security infrastructure. It also claimed that the global digital certificate business was different from its Indian digital signature business, for which it remains in MeitY’s trusted certifiers list. “The global TLS business runs on infrastructure that is completely separate from the India DSC (digital signature certificate) business. services in India are running normally,” it further added.
For its global clients, eMudhra said it is working to prevent disruptions to critical services worldwide and to fix the certification process.
Globally, users may see alerts about data breaches or the suspension of banking services in isolated cases, though no such cases have been reported yet. MeitY, on this note, issued a statement taking note of the incident, issuing a statement on Wednesday evening that said, “MeitY has taken serious note of the reported incident. A special team has been constituted to investigate the matter.” The nodal ministry, however, claimed that the entire impact falls on eMudhra’s global business division, which MeitY is not responsible for auditing.
Independently, eMudhra claimed in its statement on Wednesday morning that it has cleared security audits conducted by all the above-cited web browsers, as required.
eMudhra also claimed that the impact on its revenue would be 1%—around ₹7 crore ($750,000), per FY26 earnings. However, it further added that the incident “may have some reputational risks on eMudhra which cannot be quantified.”
Since the incident was disclosed, eMudhra’s shares have fallen by 37% as of press time. After hitting a lower circuit on BSE on Wednesday, eMudhra was trading 18.8% lower until press time on Thursday.
It is difficult to ascertain if the weak security keys by eMudhra have directly led to any breach. Interestingly, on the same day that eMudhra acknowledged its weak certification keys, India’s largest banker, , published a statement stating that 3,897 of its users had their personally identifiable information disclosed online.
“The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” the SBI statement read.
While the two incidents could not be materially linked, breaches that could lead to SBI’s data being leaked online may occur more frequently if weak encryption keys are used to verify a website—creating scope for attackers to steal sensitive information without being detected.
For now, there have been no clearly disclosed, direct breaches resulting from the incident.
