In October 2026, everyone was suddenly talking about eMudhra. In this special, Kosh explains to Fin what went wrong, and whether you need to worry. This post reflects what was known on 22 October 2026.
Swipe or use the arrows
Websites carry ID cards
Every secure website shows your browser a digital “ID card” (a certificate) to prove it’s genuine. Companies called certificate authorities, like eMudhra, issue these cards and sign each one with a secret master stamp that only they should be able to use.
What went wrong
The secret code behind 8 of eMudhra’s stamps turned out to be extremely weak. In one case, it was literally the number 4. Anyone could have guessed it in under a second and printed fake ID cards, for example for a fake bank website.
How the industry responded
Chrome, Firefox, Apple and Microsoft moved to block those stamps within days. eMudhra said a flawed key setup in April 2025 caused the problem and that its systems were not hacked. Its shares fell about 20% on 21 October.
Should you panic?
No. The government said Aadhaar eSign and digital signature certificates (DSC) were not affected, and no misuse had been confirmed. The simple step is to keep your phone and browser updated, so the blocks reach you.
For businesses that sell trust, security basics aren’t optional.
Frequently asked questions
Was Aadhaar eSign affected by the eMudhra issue?
According to the government, Aadhaar eSign and digital signature certificates were not affected, and no misuse had been confirmed as of 22 October 2026.
What should I do about the eMudhra certificate problem?
Keep your phone, computer and browser updated so you receive the browser makers’ blocks.
Part of our Kosh & Fin visual stories. New ones every week on Instagram: @kosh_fin