Cybersecurity lapses: Centre orders probe against Bengaluru-based eMudhra

The Central government has ordered a full investigation into Bengaluru-based digital certification agency eMudhra Limited, following the discovery of severe flaws in its cryptographic security keys. Authorities identified critical vulnerabilities in eight secret private keys issued by the company, raising major cybersecurity concerns.

Typically, digital private keys consist of complex random numbers that are 116 digits long. However, due to a technical glitch at eMudhra, weak keys containing very small numbers like '4' were registered. Cybersecurity researchers warned that this flaw could allow cybercriminals to generate fake website certificates and potentially alter or steal user data.

Following the discovery, global tech giants including Google, Mozilla, Apple, and Microsoft immediately blocked the eight affected certificates on their web browsers. The national cybersecurity agency CERT-In has also issued an official advisory regarding the incident. A special probe team appointed by the government is currently conducting a detailed investigation into how the error occurred.