The Ministry of Electronics and Information Technology has urged industry bodies to strengthen certification oversight and conduct regular audits following certificate weaknesses and a suspected exposure of SBI customer data.
The Ministry of Electronics and Information Technology has told industry groups to tighten certification checks and carry out regular security audits after a run of cybersecurity incidents, including weaknesses linked to eMudhra and a suspected data exposure at State Bank of India. S Krishnan, the ministry secretary, said the government had written to the relevant associations to push for better oversight of certifications and routine auditing so similar lapses do not recur.
Krishnan’s comments came as officials reviewed a cluster of incidents reported over a two-day period. The PHP Foundation issued an urgent update after discovering two critical vulnerabilities in the widely used programming language, while reports in the Indian market pointed to weaknesses in eMudhra-issued certificates and a possible leak involving SBI customer information on the dark web. According to the reports, the bank has launched an investigation and said its operations remain unaffected.
The SBI case has drawn particular attention because the alleged exposure involves a large volume of records. TechRadar reported that the bank was alerted in mid-October by its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, or CERT-In, after data reportedly appeared for sale or sharing online. The outlet said about 375,000 records were referenced, including a smaller set containing personally identifiable information such as names, phone numbers, dates of birth, email and residential addresses, customer identifiers and loan-related details. Mid-Day separately reported that the bank is investigating 3,897 customer records and has activated incident-response procedures while it assesses the source and possible risks.
The eMudhra episode has also raised wider concerns about the resilience of certificate infrastructure. Tom’s Hardware reported that eight intermediate certificate authority certificates were issued with extremely weak private keys, creating a risk that attackers could impersonate websites or disguise malicious software as legitimate. eMudhra later revoked the certificates, while browser and platform vendors moved to block the affected credentials. Against that backdrop, Krishnan said India’s push to expand digital transactions must be matched by stronger security hygiene and better protection of the infrastructure that supports them.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
