India Developing · eMudhra private key compromise: CERT-In finding, MeitY probe and Chrome root removal

eMudhra says eight private keys were compromised; MeitY sets up probe team

eMudhra disclosed that eight private keys tied to its certificates were compromised after a CERT-In advisory; MeitY says Indian sites were barely affected and has formed a special team.

Level 3 · Researched 22 Oct 2026 18 reports compared 2 of 12 claims held up · 1 contested 9 knock-on changes traced

In 30 seconds

eMudhra said private keys for eight of its certificates were compromised.
CERT-In said the keys were generated with too little randomness, making them easy to recover.
MeitY says Indian Digital Signature Certificates and eSign services were not affected.

Why it matters

Weak keys could let attackers fake secure websites and signed software, so browser makers and companies that rely on eMudhra certificates had to act.

Who it reaches

Small business owner
Tech & Startups
Companies & Business
Saver or investor
Markets & Investing
Salaried taxpayer

See how, step by step ↓

8 certificates eMudhra certificates whose private keys were compromised

27 October 2026 Date Google will remove eMudhra's root from Chrome

1 per cent Share of eMudhra revenue from affected global TLS business

3,897 records SBI customer records suspected exposed on dark web

What it sets off

Who made the decision, why they say they did it, and every change it leads to for real people, step by step. Each step says how we know it. Tap any card for the reasoning and the source.

8 changes, up to 2 steps out · 6 bad · 1 good for those affectedReachesSmall business owner Companies & Business Saver or investor Tech & Startups Markets & Investing Salaried taxpayer

2026-10-22eMudhra disclosed that eight private keys were compromisedOthers say: The disclosure followed an advisory from CERT-In (CERT-In)

Green edge: good for those affected; red: bad; grey: mixed. Reported and Expert view steps come from a named source; Our reasoning steps are not stated anywhere and follow through the mechanism shown, so we are less sure of them. Bars show how sure we are, and that falls with every step. How we reason

The argument

eMudhra

eMudhra says its infrastructure was not compromised and only a small part of its global TLS business was affected.

They say no data was breached and all physical and logical security controls remained intact.
They say the incident had no connection with their Indian Digital Signature Certificate and eSign businesses.
They say the affected global TLS business accounts for around 1 per cent of their revenue.
They say they started incident response, contained the affected certificates, and worked with browser and root-store operators.

CERT-In and independent researchers

CERT-In and independent researchers say the keys were generated with too little randomness and were easy to recover.

They point to CERT-In's finding that the private keys were generated with insufficient cryptographic randomness.
They point to a flaw in eMudhra's April 2025 key generation ceremony that produced a second set of weak keys.
They point out that some private keys were single- or double-digit numbers, like the digit 4.
They warn that an attacker who recovers these keys could issue fraudulent certificates and impersonate legitimate websites.

Where they splitWhether eMudhra's infrastructure and security controls were compromised, given that eight of its private keys were weak and recoverable.

Common groundeMudhra disclosed that private keys for eight of its certificates were compromised. The disclosure followed an advisory from CERT-In. MeitY formed a special team to investigate the incident. MeitY said Digital Signature Certificates and eSign services regulated by the CCA remain completely unaffected.

How it unfolded

The whole developing story →

Apr 2025 eMudhra holds a key generation ceremony that produces a second set of weak keys.
20 Oct eMudhra discloses that private keys for eight of its certificates were compromised.
21 Oct SBI says it is investigating suspected dark-web exposure of 3,897 customer records.
22 Oct MeitY says it has taken serious note and forms a special team to investigate.
22 Oct eMudhra shares fall nearly 20 per cent to a 52-week low.
27 Oct Google plans to remove eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store.

What we checked

2 held up · 1 contested · 9 open or from one source

Claim	Status	What the evidence says
eMudhra claimed its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact.	Disputed	eMudhra's claim that its infrastructure was not compromised, no data was breached, and security controls remained intact is contradicted by multiple established sources reporting that eight of its intermediate private keys were compromised due to a flaw in its key generation ceremony that produced weak, trivially recoverable keys. eMudhra itself acknowledged the flaw and revoked the affected certificates, though it maintains its internal systems were not breached and its root certificates were unaffected. The evidence thus conflicts: the company's narrow denial coexists with documented compromise of keys it generated and published.1 source
Shares of eMudhra plunged nearly 20 per cent to a 52-week low on October 22, 2026.	Single source	1 source
SBI said it is investigating the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web.	Single source	1 source
eMudhra said the incident had no connection with its Indian Digital Signature Certificate and eSign businesses and affected only a small part of its global TLS business.	Single source	1 source
The ministry said the incident primarily affected eMudhra's global certificate business.	Single source	1 source
MeitY said in a post on X that it had taken "serious note" of the incident and would look into the matter.	Single source	1 source
MeitY said CERT-In had issued an advisory on the incident, including mitigation measures.	Single source	1 source
eMudhra has issued more than 60 million digital certificates to date.	Single source	1 source

DisputedeMudhra claimed its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact.eMudhra's claim that its infrastructure was not compromised, no data was breached, and security controls remained intact is contradicted by multiple established sources reporting that eight of its intermediate private keys were compromised due to a flaw in its key generation ceremony that produced weak, trivially recoverable keys. eMudhra itself acknowledged the flaw and revoked the affected certificates, though it maintains its internal systems were not breached and its root certificates were unaffected. The evidence thus conflicts: the company's narrow denial coexists with documented compromise of keys it generated and published.

Single sourceShares of eMudhra plunged nearly 20 per cent to a 52-week low on October 22, 2026.

Single sourceSBI said it is investigating the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web.

Single sourceeMudhra said the incident had no connection with its Indian Digital Signature Certificate and eSign businesses and affected only a small part of its global TLS business.

Single sourceThe ministry said the incident primarily affected eMudhra's global certificate business.

Single sourceMeitY said in a post on X that it had taken "serious note" of the incident and would look into the matter.

Single sourceMeitY said CERT-In had issued an advisory on the incident, including mitigation measures.

Single sourceeMudhra has issued more than 60 million digital certificates to date.

The full story5 questions answered

eMudhra disclosed that private keys for eight of its certificates were compromised. CERT-In said the keys were generated with insufficient randomness, making them easy to recover. MeitY said Indian Digital Signature Certificates and eSign services were unaffected and formed a special team to investigate. Google will remove eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store on October 27, 2026. eMudhra shares fell nearly 20 per cent to a 52-week low on October 22, 2026. MeitY has formed a special team to investigate the incident at eMudhra. Google plans to remove eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store on October 27, 2026. eMudhra shares fell nearly 20 per cent to a 52-week low on October 22, 2026.

How exactly were the eight private keys compromised, and which certificates were affected?

A flaw in eMudhra's April 2025 key generation ceremony produced a second set of weak keys that were used for eight intermediate certificates.

Is CERT-In's finding that the keys were generated with insufficient randomness confirmed?

Yes, CERT-In's advisory says the keys were generated with insufficient randomness, and Google's Chrome Root Program independently describes them as weak.

Did Google announce removal of eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store on October 27, 2026?

Two reports say Google announced the removal for October 27, 2026, though another report describes blocking of intermediate certificates instead.

What could an attacker do with the affected certificates, and which browsers and trust stores acted?

An attacker could forge HTTPS certificates for any domain and fake code-signing certificates; Chrome, Firefox, Apple, Microsoft and Sectigo acted.

Is eMudhra's claim that its infrastructure was not compromised consistent with eight private keys being compromised?

The claim is disputed: eMudhra says its systems were not breached, but its own statement acknowledges a flaw that produced weak keys.

Still unknown5

When were the keys first suspected compromised, when did CERT-In issue its advisory, and when did eMudhra and MeitY respond?
Who leads MeitY's special probe team, what powers does it have, and what is its timeline?
What is the basis for MeitY's claim that impact on Indian websites was 'very limited', and how many Indian domains used the affected certificates?
Is the eMudhra incident connected to the reported SBI dark-web exposure of 3,897 customer records?
What regulatory or legal consequences could follow for eMudhra, such as CCA or CERT-In action or loss of its CA status?

Who reported it18 reports

People and photos10 names

eMudhra Bengaluru-based certificate authority whose private keys were compromised
Ministry of Electronics and Information Technology constituted special probe team; said Indian impact very limited
CERT-In issued advisory on the compromise and mitigation measures
Mozilla web browser company that published report on the compromised keys
Controller of Certifying Authorities regulator of Digital Signature Certificates and eSign services
Google blocked affected TLS keys in Chrome and removed eMudhra root CA
State Bank of India bank investigating suspected dark-web exposure of customer records
Chrome Root Store program from which eMudhra's root CA is being removed

Terms explained8

private keys: Secret codes used to prove a website's identity and encrypt traffic.
certificates: Digital documents that prove a website or software publisher is who it claims to be.
CERT-In: India's national agency that responds to computer security incidents.
MeitY: India's Ministry of Electronics and Information Technology, which makes tech policy.
Digital Signature Certificates: Certificates issued in India to sign documents electronically, regulated by the CCA.
eSign: An Indian service for signing documents online using a digital signature.
CCA: The Controller of Certifying Authorities, the Indian regulator for digital signature certificates.
Chrome Root Store: The list of trusted certificate authorities that Google Chrome uses to check websites.

How we made this

We read 18 sources, checked 12 claims and answered 5 questions. Every underlined line links to what it rests on. Impact steps marked "Our reasoning" are not stated by any source; see how we reason.

NOSIDES.

Sections