CERT-In warned of fake website risks after a security flaw at eMudhra. The breach affected eight digital certificates, prompting Google and Mozilla to block them on October 17. The Ministry of Electronics and Information Technology said it has taken serious note of the reports and started a special team investigation.
Cybersecurity agency CERT-In has warned of risks from fake websites and malicious software following a security flaw at eMudhra, a digital security and document-processing technology provider. The breach affected eight digital certificates whose private keys could be recovered. These keys could potentially be used to create fake website certificates or make malicious software appear to come from trusted publishers.
The incident prompted action from major browser operators after it was reported on October 17. Google blocked the affected public-key hashes in Chrome while Mozilla implemented protections in Firefox.
These measures are intended to prevent the compromised certificates from continuing to be trusted by protected browser installations. Additionally, the Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident, saying it has taken serious note of the reports. The ministry said the consequences for Indian websites and applications had been limited in both scale and duration, while cautioning against exaggerated claims circulating on social media.
The ministry also sought to distinguish the affected business from eMudhra's domestic digital-signature operations. The company provides digital signature certificates and eSign services regulated by the Controller of Certifying Authorities (CCA), as well as digital certificates used internationally to authenticate websites, software and online communications.
The reported breach relates to the latter business, which operates under an international trust framework and undergoes independent audits, including WebTrust audits conducted by BDO International. MeitY said it does not audit this international business. It confirmed that digital signature certificates and eSign services regulated by the CCA remain unaffected.
In its account of the incident, eMudhra said the affected certificates originated from a key-generation exercise in April 2025. The company said the problem was confined to the eight intermediate authorities and is taking adequate steps to contain the affected certificates. It added that it is working with browser makers and operators of trusted certificate systems to protect users and limit the impact.