eMudhra security incident had 'limited impact' on Indian sites: MeitY

MeitY reports that a security incident at eMudhra had a limited, brief impact on Indian websites. The ministry has formed a special team to investigate, clarifying that eMudhra's Digital Signature Certificate services remain completely unaffected.

The Ministry of Electronics and Information Technology (MeitY) has said the security incident involving eMudhra's global digital certificate infrastructure had a limited, short-lived impact on Indian websites and applications, as it constituted a special team to investigate the matter.

In a series of posts on X, the ministry said it had taken serious note of the reported incident and was working with stakeholders to resolve the matter. It also clarified that eMudhra's Digital Signature Certificate (DSC) and eSign services regulated by the Controller of Certifying Authorities (CCA) under MeitY remained completely unaffected. “The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” the ministry said.

MeitY Clarifies Scope of Incident

MeitY said eMudhra operates in two distinct areas. The first covers the issuance of digital signature certificates and eSign services regulated by the CCA, while the second involves digital certificates trusted by major browsers and operating systems to secure websites, software and online communications.

The ministry clarified that the reported incident relates only to the second function, which operates internationally under a global trust framework and is subject to independent audits, including WebTrust audits conducted by BDO International Limited. MeitY said it was not involved in auditing this part of eMudhra's operations.

Incident Background and Response

The clarification follows a security incident involving eight intermediate digital certificates issued under eMudhra's global Public Key Infrastructure (PKI), used to establish trust in digital certificates and secure online connections. The issue came to light on October 17 after a researcher alerted Google and other technology companies that private keys associated with the certificates were vulnerable. Google and Mozilla subsequently moved to block the affected certificates.

eMudhra said all eight affected intermediate certificates were revoked on October 19 and that none had issued customer certificates. The company also said its infrastructure was not compromised and no data breach had occurred.

Investigation and Advisory

MeitY said the Indian Computer Emergency Response Team (CERT-In) had issued an advisory on the incident, including mitigation measures. The ministry said further details would be shared after the investigation is complete, while it continues to engage with stakeholders to resolve the matter. (ANI)

(Except for the headline, this story has not been edited by Asianet Newsable English staff and is published from a syndicated feed.)