The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites. The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed , it emerged on Tuesday (October 20, 2026).
Yash Kadakia, founder of the Security Brigade cybersecurity firm, said that the impact of this leak, even if patched on browsers, could extend to internet-of-things (IoT) devices that are not frequently patched to address certificate compromise incidents like this. “The cleanup could be enormous, particularly for devices and software that cannot be easily updated,” Mr. Kadakia said.
Since the web security industry is built on trust, however, this reputational hit may hit the firm in particular very heavily, as customers and browser developers alike reassess whether eMudhra’s certificates are reliable or not.
“Upon becoming aware of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem,” eMudhra said on its website.
