What does eMudhra’s web security key leak mean for internet users? | Explained
Bengaluru-based eMudhra recently suffered a leak of eight private keys used for issuing web security certificates, prompting an advisory from CERT-In. The exposure could potentially allow attackers to intercept encrypted traffic, though browser developers have already begun issuing patches.
Why it matters
The compromise of a root certifying authority threatens the fundamental trust mechanism of the internet, potentially affecting government and banking websites.
What does eMudhra’s web security key leak mean for internet users? | Explained left A private key is part of a cryptographic pair in secure communications, with a public key being used in combination with it to create a message that disallows interception. Getty Images/istockphoto Getty Images/istockphoto https://th-i.thgim.com/public/incoming/itg4ey/article71610067.ece/alternates/FREE_1200/iStock-1350595566.jpg Galeanu Mihai Cyber security firewall interface protection concept. Businesswoman protecting herself from cyber attacks. Personal data security and banking The exposure of eMudhra’s private keys could allow for man-in-the-middle attacks if left unpatched on all devices The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in