eMudhra incident: MeitY forms probe team, shares fall as much as 20%
The government has set up a special team to examine the security incident, while saying Indian DSC and eSign services were not affected.
The 30-second read
- MeitY formed a special team to probe the eMudhra incident, which involved eight intermediate CA certificates.
- CERT-In issued an urgent advisory, and reports say DSC and eSign services were unaffected.
- CNBC-TV18 first reported that eMudhra shares slid by up to 20% on Wednesday, October 21.
MeitY has set up a special team to investigate a security incident at eMudhra. Eight intermediate CA certificates were compromised, as reported by CNBC-TV18 and Mint. CERT-In issued an urgent advisory with best practices for government organisations and enterprises. MeitY took "serious note", first reported by Business Today. It also warned social media handles against fear-mongering.
Reports say Indian websites and apps saw only a very limited and brief effect. DSC and eSign services were unaffected. The reason lies in how eMudhra works. It runs CCA-regulated DSC and eSign services in India. Separately, it issues globally trusted certificates for browsers and operating systems. The incident relates only to the second part, whose audit MeitY does not oversee.
CNBC-TV18 first reported more technical details. It said CERT-In found that the keys were made with weak cryptographic randomness, so they could be recovered almost instantly. It also reported, citing a Mozilla post quoted by eMudhra, that the keys were compromised on October 17. Mozilla and Google took emergency steps, including automatic blocking, and Mozilla blocked the certificates through OneCRL, per CNBC-TV18.
eMudhra said it began incident response, contained the affected certificates and is working with browser and root-store operators. CNBC-TV18 first reported that its shares slid by up to 20% on Wednesday, October 21.
Why it matters
Indian government bodies and enterprises are advised by CERT-In to follow recommended security practices. Indian DSC and eSign users are unaffected, but eMudhra investors saw the shares fall as much as 20%.