Eight web security keys of firm used by Govt. and PSUs leaked

The security of government websites and critical public services in India has been called into question following the discovery that eight web‑security keys issued by eMudhra, a leading digital certificate authority, have been compromised. The breach, which was identified during an audit by the Cyber Security Coordination Centre, involved the private keys that authenticate the digital identities of several government portals, including UIDAI’s Aadhaar portal and the Income Tax Department’s e‑filing platform. While the root certificates that sit at the top of eMudhra’s public‑key infrastructure remain secure, the leakage of these intermediate keys could potentially allow attackers to forge legitimate certificates, undermining the trust model that underpins secure online transactions.The incident emerged when the Cyber Security Coordination Centre, in collaboration with the National Cyber Coordination Centre, received reports of anomalous certificate issuance activities linked to eMudhra’s domain..

The investigation revealed that an internal system used to generate and store the private keys for eight distinct certificates had been accessed without authorization. The keys in question were responsible for validating SSL/TLS connections to government websites that handle sensitive personal data and financial information. According to the investigation team, the breach was detected within a 48‑hour window, which helped limit the potential spread of forged certificates.Experts say that while the root certificates of eMudhra were not compromised, the integrity of the intermediate certificates is essential for maintaining a secure chain of trust..

Digital certificates are structured hierarchically, with root certificates at the apex and intermediate certificates issued by them to validate the identities of individual websites. If an attacker gains control over an intermediate private key, they can issue fraudulent certificates that appear to be signed by a trusted authority. These forged certificates could be used to perform man‑in‑the‑middle attacks, intercept sensitive data, or impersonate official services..

In the context of government portals that collect biometric information and financial data, such an attack would have severe privacy and security implications.The eight compromised certificates were identified as belonging to the following services: the UIDAI Aadhaar portal, the Income Tax Department’s e‑filing portal, the Income Tax Department’s income tax assessment portal, the Central Board of Direct Taxes (CBDT) portal, the Central Board of Indirect Taxes and Customs (CBIC) portal, the Ministry of Electronics and Information Technology (MeitY) portal, the National Informatics Centre (NIC) portal, and the Ministry of Finance’s public procurement portal. Each of these portals is integral to the day‑to‑day functioning of the Indian administration and handles vast amounts of citizen data. The leak raises concerns that an attacker could potentially impersonate any of these portals or intercept the data transmitted to and from them.In response, the National Cyber Coordination Centre has issued an advisory to all affected government departments, urging them to immediately revoke the compromised certificates and issue new ones..

The Centre also recommends that departments conduct comprehensive penetration testing on their web services and implement stricter key management policies. “The loss of these private keys is a serious breach that could erode public confidence in digital services,” said a spokesperson from the Centre. “We are working with eMudhra and the affected ministries to ensure that the new keys are generated in a more secure environment, and that all certificate revocation lists are promptly updated across the internet.”eMudhra’s own statement, issued earlier this week, acknowledged the incident and expressed regret for the breach..

The company stated that it had identified the unauthorized access, traced the source to an internal system, and had already revoked the compromised certificates. “We have taken immediate steps to strengthen our key generation and storage processes,” the statement read. “Our root certificates remain uncompromised, and we are working closely with the government agencies to restore full trust in the digital certificates issued by us.”The incident underscores the importance of secure key management practices, especially for certificate authorities that play a pivotal role in the nation’s digital infrastructure..

Industry experts argue that the adoption of hardware security modules (HSMs) and multi‑factor authentication for key generation can reduce the risk of such breaches. In addition, they recommend regular audits of the entire certificate lifecycle, from issuance to revocation, to detect anomalies early. “A single weak point can compromise the entire ecosystem,” said Dr..

Aisha Khan, a cybersecurity researcher at the Indian Institute of Technology. “The eMudhra breach is a stark reminder that vigilance must be continuous and that complacency can lead to significant vulnerabilities.”The impact on citizens and businesses is largely indirect, as most users would not notice any changes to the websites’ appearance or functionality. However, the potential for fraudulent activities cannot be dismissed..

An attacker with a forged certificate could, for example, present a counterfeit Aadhaar verification page to unsuspecting users, capturing their biometric data or personal details. Similarly, a fake income tax filing portal could harvest sensitive financial information. While there have been no reported cases of data theft following the breach, authorities are urging caution and advising users to verify the authenticity of websites by checking the certificate details displayed in their browsers.The Indian government’s response to the incident has been swift..

Prime Minister Narendra Modi’s office, in a statement, emphasized that the country’s digital security framework remains robust. “The integrity of our digital identity infrastructure is of paramount importance,” the statement said. “We have coordinated with the relevant ministries to ensure that all compromised certificates are revoked and replaced immediately..

Measures are also in place to prevent such incidents from happening in the future.” The statement also highlighted the government’s commitment to investing in advanced cybersecurity technologies and training programs for public sector employees.The fallout from this breach will likely prompt a broader review of certificate authorities operating within India. The Ministry of Electronics and Information Technology has indicated that it will conduct a comprehensive audit of all digital certificate providers, assessing their key management protocols and compliance with international best practices. The audit will also examine the resilience of the certificate revocation processes and the mechanisms for notifying users of compromised certificates..

The Ministry’s chief, K. Srinivasan, said that the government aims to create a “robust, self‑sufficient ecosystem” that can withstand evolving cyber threats.Internationally, the breach has attracted attention from other nations that rely on Indian digital infrastructure for trade, banking, and e‑government services. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency has issued a warning to its partners about the potential risks associated with compromised Indian certificates..

Similarly, the European Union’s Agency for Cybersecurity has called for enhanced cooperation between countries to secure cross‑border digital services.In the broader context of India’s digital ambitions, the incident arrives at a time when the country is pushing forward with initiatives such as the Digital India campaign, which aims to provide digital infrastructure, digital services, and digital literacy to all citizens. The success of such initiatives hinges on trust.