A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain. Meity has taken serious note of the reported incident. A special team has been constituted to investigate the matter.

However, some social media accounts are indulging in fear mongering about the impact of this incident. The facts of the case are as follows: eMudhra operates in two distinct areas:

1. Issuance of Digital Signature Certificates and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY. 2. Issuance of digital certificates trusted by major browsers and operating systems, used to secure websites,

software and online communications. The second function is international in nature and operates under global trust framework. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.

The reported security incident pertains to this only. MeitY is not involved in its audit. The impact of this incident on Indian websites and applications have been very limited and for a very short interval.

Meity remains engaged with all the stakeholders to resolve this incident at the earliest. CERT-In has also issued an advisory in r/o the incident including the mitigation measures. Further details will be shared upon completion of the investigation.