eMudhra breach: Netizens react as IT Ministry says impact on Indian sites ‘very limited’

After government digital certification authority eMudhra disclosed that private keys tied to eight of its intermediate certificates had been compromised, social media had a field day, slamming the agency and poor cybersecurity measures by the government.

The IT Ministry said it had taken "serious note" of the incident and constituted a special team to probe the matter.

What happened?


eMudhra issues certificates for digital signatures that are used for online transactions by all kinds of business entities.

Cybersecurity agency CERT-In warned that the compromised keys could let attackers issue fraudulent certificates for domains they do not control, impersonate legitimate websites and carry out attacks that intercept or modify encrypted communications.

eMudhra said a flaw in its system created a set of weak keys alongside the original strong ones.

The company said its infrastructure was not compromised, no data was breached, and its Indian digital signature certificate and eSign businesses were unaffected.

The IT Ministry said the reported incident pertains to eMudhra’s global certificate business and its impact on Indian sites is very limited. It also said some social media accounts were indulging in fear-mongering about the impact.

Reactions

Users seethed at what they called "gross negligence by the company".

Venture investor Deedy Das said in a post on X, "Embarrassing that it’s a family business run by largely computer illiterate people. Only 1 of the 3 have a remotely computer-related background and even they never actually worked a technical job in their life."

Another user called it "a shocking degree of incompetence, stupidity and gross negligence. … It is insane and scary how this company managed to grab so much government business with this hyper incompetence," he wrote.

Hitting back at the IT ministry's "fear mongering" comment, one person wrote, "Do something stupid and then gaslight everyone to say those who’re voicing it out are fear mongerers."

Actor Kunal Kapoor also weighed in, calling for people to update their browsers and operating systems. "Imagine it like someone forging passports that border control can’t tell are fake. Browsers have already moved to block them. Updating makes sure the fix reaches you," he wrote.

"What a terribly poor situation. And it happens because of lack of actual meritocracy in India," another user wrote.