eMudhra Security Scare: Expert Warns Against Over-Sharing Personal Data
Cybersecurity expert Pavan Duggal warns against excessive data sharing following a cryptographic vulnerability at eMudhra.
In the wake of emerging eMudhra security concerns, renowned cybersecurity expert Pavan Duggal has issued a stern warning to the public about the dangers of excessive personal data sharing. Speaking in an exclusive conversation with ANI, Duggal urged individuals to adopt a "need-to-know" approach, disclosing personal information only when absolutely necessary and independently verifying electronic data before trusting it.
The Danger of False Security
Duggal emphasized that many people mistakenly believe their data is automatically safe if it is held by government agencies or large institutions. He stressed that the responsibility for data protection does not lie solely with the state.
"We should not assume that protecting all our data is solely the government's responsibility and that the government will protect everything without any action on our part. You are the custodian of your own data, and you need to take steps to protect it at a personal level," Duggal stated.
What Happened at eMudhra?
The current alarm stems from a security incident involving eMudhra, a company that provides digital signature certificates. These certificates are critical for authenticating electronic information and ensuring trust in online services and digital transactions.
The issue traces back to a system error in April 2025, which led to the generation of weaker cryptographic keys. This vulnerability was flagged by an independent security researcher, sparking fears about the safety of systems relying on these compromised certificates.
Potential Risks to Users
According to Duggal, systems utilizing the affected certificates could be exposed to several security threats, including:
- Unauthorized Access: Hackers could potentially gain entry to websites, servers, or personal computers.
- Data Exposure: Such breaches could lead to the leakage of confidential information or sensitive banking details.
However, it is important to note that these are potential risks. There is currently no confirmed evidence that affected systems have been hacked or that data has already been stolen.
Government Investigation and Legal Demands
The Ministry of Electronics and Information Technology (MeitY) has already formed a team to investigate the root cause of the weak key generation. The probe aims to determine:
- Exactly when eMudhra detected the problem.
- What immediate steps the company took to mitigate potential damage.
- Whether the incident was reported to the Indian Computer Emergency Response Team (CERT-In).
Duggal has gone a step further, calling for a formal law-enforcement investigation. He argued that an FIR should be registered under the Information Technology Act and the Bharatiya Nyaya Sanhita to hold those responsible for any wrongdoing accountable.
Global Impact and Digital Payments
The expert noted that the potential exposure might not be limited to India, as systems in other countries using these certificates could also be at risk. However, he clarified that not every user, application, or website is necessarily affected.
Addressing the anxiety surrounding digital money, Duggal mentioned that there is no immediate risk to the Unified Payments Interface (UPI), as it functions on a different platform and framework. Nevertheless, he cautioned that this specific assessment should not be taken as a guarantee that all other digital services are entirely risk-free.