eMudhra has appointed KPMG as an independent reviewer to investigate a security incident involving weak digital certificates, following a human and script error that led to distrust by major browser companies like Google and Mozilla.
eMudhra Appoints KPMG to Review Security Incident
Bengaluru-based digital trust and cybersecurity company eMudhra Limited has appointed KPMG as an independent external reviewer to examine a security incident involving eight intermediate digital certificates that led to major browser companies distrusting them. In an official statement on Friday, the company said the appointment fulfils its commitment made in a press release on October 21 to have an independent entity examine the matter. It said, “eMudhra Limited today announced the appointment of KPMG as its independent external reviewer following the incident that led to the distrust of select global TLS intermediate certificate authorities earlier this month”.
The security incident involved eight intermediate Certificate Authority (CA) certificates associated with eMudhra's global website security business. The private keys linked to these certificates were found to be weak enough to be mathematically calculated, raising concerns that they could potentially be misused to create fraudulent certificates and impersonate legitimate websites. Following the discovery, browser companies, including Google and Mozilla, took steps to distrust the affected certificates to reduce potential security risks.
Details on the Cause of Security Failure
Earlier, in an exclusive conversation with ANI, eMudhra Co-Founder Kaushik Srinivasan attributed the incident to human error and a script failure during a routine key-generation process. He said the incident occurred on April 30, 2025, when a script error resulted in the creation of weak cryptographic keys on hardware. “There was no infrastructure breach or data breach or anything. This was admittedly a human error caused by a script, you know, a sort of error that happened on April 30th, 2025, where these weak keys were created basically on hardware,” Srinivasan told ANI. He also acknowledged that the company did not have adequate manual checks in place to prevent the error.
Srinivasan said no customer data breach or cyberattack had occurred and that only a limited number of customers were directly affected. The latest appointment of KPMG marks the company's move to bring an independent review of the incident after the affected certificates were distrusted by browser companies. The review is expected to provide clarity on what happened and help eMudhra identify and address any issues arising from the incident.
(Except for the headline, this story has not been edited by Asianetnews Editorial staff and is published from a syndicated feed.)
