eMudhra Security Incident: Company Pledges Enhanced Operational Controls

eMudhra cofounder Kaushik Srinivasan tells Entrepreneur India that the company will improve operational security controls following the recent security incident. 

In case you did not know, eMudhra’s some certificates were spotted with weak keys, making them extremely vulnerable to reverse engineering through brute-force attacks and key derivation due to low entropy.

“Imagine your apartment society has a security guard at the gate. The guard doesn’t know every visitor personally, so he follows one rule: if your visitor pass has the official society stamp, you’re allowed in,” Noel Varghese, Cyber Threat Researcher, CloudSEK explains it to Entrepreneur India. 

“eMudhra is one of the few offices trusted to make that official stamp. Your browser is the guard, and the padlock you see next to a website’s address is the stamp on the pass. Every stamp is protected by a secret number. Normally, that number is so long that guessing it is practically impossible, even for the world’s most powerful computers,” he continued. 

The problem was that In eMudhra’s case, the secret numbers behind eight of its stamps were all below 256, and one of them was simply the number 4. That meant anyone could break them in under a second. With a copied stamp, a fraudster could make a pass that looks completely genuine, and the guard would let them in without a second look.

The danger wasn’t limited to eMudhra’s own customers, because that copied stamp could have been used to establish trust for any website.

“On the internet, this means a fake banking or government website could show the same padlock as the real one, and your browser would trust it. No adversary has been found misusing it so far. Once the flaw was reported, Google, Apple, Microsoft and Mozilla quickly blocked the affected eMudhra certificates, so those copied stamps would no longer be accepted,” added Varghese.

Following the security incident, Mozilla in a blog post disclosed that private keys associated with eight eMudhra intermediate certificates had been compromised. 

“Mozilla engineers responded immediately, blocking the affected certificates in Firefox using OneCRL, Mozilla’s centralized list of revoked certificates. OneCRL delivers this protection without requiring users to update or restart Firefox.

By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations,” the company said in a blog post. 

Google followed by updating these trusted certificates list in NSS which removes the root certificate used to sign these intermediates.

“We have since been working with the issuing CA, other root programs and downstream trust store operators to investigate the root cause, responsibly disclose the incident and help protect the wider ecosystem. 

Today, 20th October, we are also releasing an update to the trusted certificates list in NSS which removes the root certificate used to sign these intermediates. Although this change is not necessary for Firefox, this helps protect other users of our trust store or third party derivatives who do not benefit from the protection of OneCRL. This change will impact the availability of some servers for those non-Firefox users until those servers move to new certificate chains,” it said.

Srinivasan, however, said that keys never leaked. 

“So, we had no infrastructure breach or data breach or data loss or data theft or anything of that sort. This is more a question of being able to reverse engineer a key that was already in public for 18 months… the issuing CAs never went into production barring one, we never issued any end-entity certificates,” he explained. 

On the course correction, he said that the company was looking to improve its security controls, which includes deployment of AI in some of the processes to aid the checker or add an additional reviewer layer. 

“That’s what can be bettered. Internal reassessment of maybe what all additional checks and balances in the processes we can put to ensure that something like this doesn’t repeat? That is really what I think we will do going forward. But for this specific incident, we’ve anyway committed to an independent review which we will commission and share the findings with the public shortly,” he added. 

Srinivasan also disclosed that the IT Ministry (Meity) had sought responses from the company over the incident. 

“We’ve answered all of those questions. They wanted to understand the impact on Indian DSC and eSign business, which we clarified. They’ve come out with a clarificatory statement. Uh as and when they ask additional questions around this, we will continue to keep answering,” he added. 

AI Curveball 

Cybersecurity incidents are quite common. 

Back in 2017, a ransomware called WannaCry wreaked havoc worldwide by targeting computers running Microsoft Windows operating systems, encrypting data, and seeking ransom payments in the form of bitcoins. Reported in the same year, Yahoo! apparently suffered a major data breach in 2013–14 affecting all users. It’s also considered to be one of the biggest cyber attacks in history. There are several examples of ransomware and malware targeting companies of all sizes in the last decade or so.

Things, however, have changed with the AI. 

Earlier this year, Anthropic unveiled Claude Mythos Preview, a general-purpose language model focused on cybersecurity tasks.

Anthropic researchers disclosed that Mythos Preview was capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and major web browser if directed by a user to do so.

It is capable of identifying vulnerabilities that are typically difficult to detect. In one of the cases, Mythos discovered a now-patched 27-year-old bug in OpenBSD, an operating system known for security features. Essentially, it is also capable of finding vulnerabilities classified as ‘zero-day’—a security flaw that is unknown to the vendor or developers and requires immediate action to fix.

ALSO READ: The Dawn of the Autonomous Cybersecurity Era & Risks To SMEs

IBM’s 2025 report found that 13% of surveyed organisations had experienced breaches involving their AI models or applications. Among those reporting such incidents, 97% lacked proper AI access controls. These findings highlight a critical gap: adopting AI faster than we secure it can create new vulnerabilities instead of reducing existing risks.

“AI is changing the speed and scale of both cyberattacks and cyberdefence. Attackers can use it to create convincing phishing messages, automate reconnaissance, identify weaknesses and make impersonation attempts harder to detect. On the defensive side, AI can help security teams analyse large volumes of alerts, identify unusual behaviour and respond to threats faster. The advantage will belong to organisations that combine these capabilities with strong fundamentals and human oversight,” Subir Sangal, CEO, Eagle Information Systems, tells Entrepreneur India. 

“The immediate priority is to build security around three pillars: visibility, verification and response. Organisations need visibility across their networks, cloud environments, identities and AI applications; stronger verification of users, devices and digital credentials; and the ability to detect, contain and recover from incidents quickly. This is where an AI-enabled SOC (Security Operations Center) can play a critical role by correlating security alerts across multiple systems, prioritising genuine threats, reducing alert fatigue and helping security teams accelerate threat detection and response. AI systems themselves must also be secured through access controls, data protection, monitoring and clear governance,” Sangal continues. 

On AI, Srinivasan adds that everybody has to be prepared because AI gives people a lot more adversarial capability. This is why more audits are conducted in a timely manner. 

“So some way of moving to a continuous assessment framework through the use of AI on every process needs to be baked in. More stringent operational security controls have to be brought. And I think, you know, today what we saw was reverse engineering of a key that, you know, resulted in a small kind of integer,” Srinivasan said.

Srinivasan also highlighted that what we saw was reverse engineering of a key that resulted in a small kind of integer. 

“But what’s to say that with the advent of a quantum computer even larger public keys cannot be broken? So there has to be an accelerated transition to post-quantum cryptography, and to start doing that, you have to do something called an assessment of what keys, certificates you already hold, right? Because many people issue keys that are not publicly trusted for payments or various other things. So how do you really do and follow regulatory advice around doing something known as a CBOM, what’s the transition to post-quantum cryptography,” he said. 

Impact & Fallback plan

Following the incident, eMudhra announced that the company was withdrawing from the global SSL/TLS certificate business.

Srinivasan said the move will not have a big impact as the vertical contributed only 1.5 percent of the total revenue. 

“Come next year, the entire industry will issue 90-day certificates. So, when your players are issuing free at scale, the commoditization will happen quite rapidly. Uh so, that’s why for a player like us who’s hugely focused on enterprise solutions where this is only a tiny portion of what we do, what is the ROI given all of the compliance overheads, barriers, uh right, investments that are required? So, the board felt it was probably prudent to withdraw from this line of business and continue, uh right, and that’s a decision that was taken and communicated,” he explained. 

That said, the eMudhra incident did spook the internet. 

Varghese of CloudSek notes that such incidents show that any certificate authority can fail, so the real test is how quickly organisations can recover. 

Experts also urge that every critical service should keep a second, pre-approved certificate provider ready, and should monitor public Certificate Transparency logs for any certificate issued in its name. On the provider side, key generation would benefit from independent technical verification alongside procedural audits, so that weak keys can be caught before any certificate is issued.