eMudhra Blames 'Human Error' for Security Lapse; No Data Breach Reported
eMudhra attributes a security incident involving weak digital certificates to human error and script failure. No data breach occurred.
Bengaluru-based cybersecurity and digital trust giant eMudhra has addressed a security incident involving eight intermediate digital certificates, attributing the lapse to a combination of human error and a script failure. While the incident raised alarms regarding cryptographic vulnerabilities, the company's Co-Founder, Kaushik Srinivasan, has clarified that there was no cyberattack or breach of customer data.
What Went Wrong?
The incident traces back to April 30, 2025, during a routine key-generation process. According to Srinivasan, a script error occurred during this procedure, which led to the creation of weak cryptographic keys on the company's hardware. These weak keys were mathematically vulnerable, meaning they could potentially be calculated by unauthorized parties, creating a risk where fraudulent certificates could be issued to impersonate legitimate websites.
Srinivasan admitted that the company's internal safeguards were insufficient at the time. He noted that while the key-generation "ceremony" is a routine task performed by the team for years, the lack of adequate manual checks and "maker-checker" controls allowed this specific lapse to go unnoticed.
Impact on Customers and Browsers
The vulnerability affected eight intermediate Certificate Authority (CA) certificates tied to eMudhra's global website security business. In response to the risk, major browser companies, including Google and Mozilla, took action to distrust the affected certificates to protect users.
Key Details of the Impact:
- Limited Exposure: Out of the eight affected issuers, seven never even entered production. The one that did enter production had not issued any identity certificates to end users.
- The US Client: While no data breach occurred, the "distrust" action by browsers impacted some users. One US-based customer had approximately 30,000 certificates associated with the affected Elliptic Curve Cryptography (ECC) route.
- RSA Route Safe: The company emphasized that its RSA route, which handles the majority of its certificate issuances, remains trusted by browsers and was unaffected.
The Situation in India
In India, eMudhra is managing "perception risk." Although a limited number of Indian customers were not directly affected by the technical failure, the company is considering migrating them to alternative providers to maintain trust.
The company is currently coordinating with browser programs and the Ministry of Electronics and Information Technology (MeitY). MeitY has since clarified that India's eSign and Digital Signature Certificate (DSC) businesses were not impacted by this incident.
The Path Forward: AI and Stricter Controls
To ensure such a failure does not happen again, eMudhra is focusing on enhancing its security and quality control frameworks. The company is exploring the integration of automated tools and Artificial Intelligence (AI) to supplement human oversight and eliminate manual errors.
Moving forward, eMudhra is taking the following steps:
- Internal Audit: An internal report detailing the sequence of events is expected within three to four days.
- Independent Review: The company is considering an independent audit of its other keys and intends to make those findings public.
- Control Strengthening: Implementing rigorous manual and automated verification processes for all cryptographic operations.