Eight eMudhra security keys compromised; government websites potentially affected

Eight web security keys issued by eMudhra, a prominent digital certificate provider, have been compromised in what marks a significant cybersecurity incident for India's digital infrastructure. The leaked credentials are used across multiple government websites and platforms operated by public sector entities, according to sources tracking the breach.

Among the affected services are websites utilising eMudhra's digital certificate technology, with government portals including those operated by the Unique Identification Authority of India (UIDAI) and the Income Tax Department potentially in scope. Digital certificates serve as cryptographic credentials that authenticate websites and secure online transactions, making their compromise a matter of concern for cybersecurity officials.

However, security assessments indicate that eMudhra's root certificates—the highest-level cryptographic credentials that serve as the foundation for the entire authentication hierarchy—have not been compromised. Experts note that the leaked keys represent a lower tier in the certification structure, which may limit the scope of potential misuse, though investigations into the breach's full implications remain ongoing.

The incident underscores persistent vulnerabilities in India's digital infrastructure and raises questions about certificate management protocols among service providers handling sensitive government technology. eMudhra and relevant government agencies have not issued formal public statements regarding remediation measures or timelines for addressing the security lapse.