Major browser companies have blocked certificates linked to Bengaluru-based eMudhra. Eight of its intermediate certificate-authority keys were generated with too little randomness, which made them potentially recoverable by attackers. CERT-In issued an advisory on 21 October.
Websites prove their identity through digital certificates issued by certification authorities, in a hierarchy of root, intermediate and end-user certificates.
A weak key at an intermediate level could let attackers issue fake certificates, impersonate websites or sign malware.
Prelims pointers
Of the eight affected certificates, six were for authenticating websites (TLS) and two were for signing software. The flaw was reported to browser companies on 17 October by an independent researcher.
eMudhra traces the flaw to a key-generation exercise on 30 April 2025. It says only one affected authority was in production, and none had issued end-user certificates.
Google said no website certificates chaining to the affected authorities appeared in Certificate Transparency logs before it blocked them.
In India, certifying authorities that issue digital signature certificates are licensed by the Controller of Certifying Authorities (CCA) under the IT Act, 2000. Other licensed authorities include Safescrypt, Capricorn and nCode.
eMudhra is India's largest certifying authority, with about 38% of the digital signature market by value. It says its Indian digital signature and eSign businesses run on separate infrastructure and were not affected.
Mains angle
Internet security rests on trust in a few certification authorities. One lapse can undermine HTTPS, so key management needs strict audits and fast revocation.
The State Bank of India disclosed in a stock-exchange filing on 21 October that personal data of some customers was exposed on the dark web. This followed alerts it received on 16 October, including from CERT-In. A preliminary review of about 3.75 lakh leaked records found 3,897 containing personally identifiable information.
A threat actor had claimed on a dark-web forum to hold about 3.75 lakh rows of SBI-linked data and 2,722 PDF files, mostly loan-related.
SBI has appointed a CERT-In-empanelled agency to establish the source and authenticity of the data.
Prelims pointers
Exposed fields include mobile numbers, dates of birth, names, email and home addresses, Customer Information File (CIF) identifiers and loan-lead metadata.
CERT-In works under MeitY and is the national nodal agency for cyber incidents under Section 70B of the IT Act, 2000.
CERT-In's 2022 directions require cyber incidents to be reported within six hours of noticing them.
The Digital Personal Data Protection Act, 2023 requires data fiduciaries to report personal-data breaches to the Data Protection Board and to affected individuals.
Under the DPDP Act, failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore.
The right to privacy is part of Article 21 (K.S. Puttaswamy, 2017).
Mains angle
Banks hold some of the most sensitive data in the economy. Leaks of loan and KYC data feed phishing and identity fraud, and test how quickly data-protection law is enforced.
JAXA launched the Martian Moons eXploration (MMX) probe on an H3 rocket from Tanegashima Space Center on 20 October. It aims to return at least 10 grams of Phobos to Earth in 2031.
The drone show, which added a touch of modern technology to the Dasara celebration, began with a visual depicting Chief Minister D.K. Shivakumar welcoming people to the Dasara festivities
