CERT-In flags website impersonation risks over eMudhra breach

Cybersecurity agency CERT-In has warned of risks from fake websites and malicious software following a security flaw at eMudhra, a digital security and document-processing technology provider. The breach affected eight digital certificates whose private keys could be recovered. These keys could potentially be used to create fake website certificates or make malicious software appear to come from trusted publishers.

The incident prompted action from major browser operators after it was reported on October 17. Google blocked the affected public-key hashes in Chrome while Mozilla implemented protections in Firefox.

These measures are intended to prevent the compromised certificates from continuing to be trusted by protected browser installations. Additionally, the Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident, saying it has taken serious note of the reports. The ministry said the consequences for Indian websites and applications had been limited in both scale and duration, while cautioning against exaggerated claims circulating on social media.