A series of cybersecurity incidents involving Indian organisations has highlighted the risks posed by weak encryption, unauthorised access to customer information and the exposure of sensitive corporate records. The incidents have affected sectors ranging from banking and healthcare to technology and critical infrastructure, raising questions about data protection and the security of digital systems.
The latest case involves a Bengaluru-based digital certificate provider whose weak cryptographic keys linked to eight certificates prompted Google, Mozilla, Apple and Microsoft to take emergency action. The flaw raised concerns about the possibility of attackers creating fraudulent digital certificates to impersonate websites or sign software as though it had come from a verified publisher.
Other incidents have involved customer records reportedly appearing on the dark web, employee email accounts being compromised and allegations of stolen medical and insurance information. While the circumstances and extent of the reported exposures vary, the cases underline the importance of robust cybersecurity controls and timely incident response.
Weak cryptographic keys trigger emergency action by tech giants
A security flaw involving Bengaluru-based digital certificate provider eMudhra Ltd came to light in October 2026 after a researcher identified weaknesses in private keys associated with eight intermediate certificates issued by the company. The discovery raised concerns about the security of digital certificates used to establish trust in websites and software.
The company acknowledged that the weak keys resulted from errors during its own processes. In responses to Mozilla, eMudhra said its staff had inadvertently used the keys during a key generation ceremony in April 2025, adding that “there were human errors in multiple steps of the process”.
Private keys are expected to be sufficiently complex to prevent them from being derived from their corresponding public keys. In this case, however, the affected keys consisted of numbers that could be recovered by testing a relatively small range of possibilities.
The weakness meant that an attacker could potentially recover the private keys and use them to issue fraudulent certificates, impersonate legitimate websites or sign software as though it had been released by a verified publisher.
Google, Mozilla, Apple and Microsoft responded by taking steps to block the affected certificates. Mozilla warned in its incident report that the ease with which the private keys could be recovered made the potential impact particularly serious.
eMudhra maintained that its infrastructure had not been compromised and that no data breach had occurred. It also said its Indian digital signature certificate and eSign businesses operated on separate infrastructure and were unaffected by the incident.
The case highlighted the wider implications of weaknesses at certificate authorities, which play a crucial role in the digital trust infrastructure underpinning secure internet connections and software authentication.
Thousands of customer records identified in suspected banking data exposure
The State Bank of India (SBI) disclosed a suspected data exposure on October 21, 2026, informing the Bombay Stock Exchange and the National Stock Exchange about an incident involving the loss of certain data.
The bank said 3,897 customer records containing personal information had been identified within a larger dataset of approximately 3.75 lakh records circulating on the dark web.
The information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch details and Customer Information File (CIF) identifiers. The dataset also contained lead IDs and metadata associated with loan records and other files.
SBI said it became aware of the incident on October 16 through its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
Following the discovery, the bank activated its incident-response protocols and appointed an independent agency empanelled by CERT-In to investigate the authenticity, source and extent of the exposure.
SBI said the incident was not expected to have a material impact on its core operations, financial performance or business continuity.
However, the disclosure did not establish how the information had left the bank's systems or what the remaining records in the larger dataset contained. The investigation remains ongoing, leaving the full number of individuals potentially affected unclear.
The incident has drawn attention to the risks associated with the exposure of banking-related personal information, which can potentially be misused for identity fraud, phishing attempts and other targeted scams.
Customer information and internal documents reportedly appear on dark web
Bank of Baroda confirmed a cybersecurity incident on July 27, 2026, after customer information and internal documents allegedly linked to the lender appeared on the dark web.
The bank said the incident involved a compromised employee email account that resulted in unauthorised access to certain data.
Cybersecurity researcher Srikanth L said the leaked material included customer details, identification documents, loan papers and internal audit records. A dark-web site advertised the dataset as containing more than 700GB of information, according to an analysis of the site's metadata. However, the full volume and authenticity of the material were not independently established.
Bank of Baroda said the incident had been identified promptly and that containment measures had been implemented. It maintained that its core banking systems had not been accessed and remained secure.
The lender also initiated a forensic investigation and said it was working with the relevant authorities to examine the incident.
The reported exposure raised concerns about the risks associated with employee email accounts, which can provide an entry point for attackers seeking access to confidential corporate documents and customer information. It also highlighted the importance of access controls, email security and rapid detection of unauthorised activity.
Files allegedly linked to nuclear power plant published online
A ransomware group's publication of files it claimed were linked to the Kudankulam Nuclear Power Plant in Tamil Nadu drew attention to cybersecurity risks surrounding strategically important infrastructure in July 2026.
The material reportedly included facility-related documents, supplier details and information about infrastructure systems. The group claimed the files were connected to the nuclear power plant, although their authenticity and the full scope of the material required careful verification.
Reliance Group confirmed a partial data breach involving a server hosted by Indian data centre provider Yotta. The group said the government had been informed about the incident.
The available information did not independently establish that the published files originated from the nuclear facility or confirm the full extent of any connection between the material and the plant.
The incident nevertheless highlighted concerns surrounding third-party data storage and contractors that manage information for organisations operating in sensitive sectors.
Data centre providers and other technology partners can hold or process significant volumes of corporate information. A security weakness affecting one of these providers can therefore raise questions about the protection of data belonging to multiple clients.
The case underscored the importance of examining third-party access, securing hosted infrastructure and verifying claims made by ransomware groups before drawing conclusions about the compromise of critical systems.
Healthcare technology firm seeks CBI probe into alleged medical data theft
Vitraya Technologies, which operates a digital platform for health insurance claims, approached the Supreme Court in 2026 seeking a Central Bureau of Investigation (CBI) probe into the alleged hacking and theft of personal and medical information belonging to more than 1.5 lakh citizens.
In its petition, the company alleged a large-scale cyber intrusion involving unauthorised access to sensitive information stored on its systems. The data allegedly included medical records, insurance claim details, Aadhaar-linked information and other personally identifiable information.
Vitraya said it detected a coordinated cyberattack in February 2025 involving brute-force login attempts, the mass downloading of confidential records and the extraction of sensitive customer data from its digital infrastructure.
The company also alleged that it approached Punjab's cybercrime police in March 2025. Despite repeated representations and cooperation during the preliminary inquiry, the police allegedly delayed registering a first information report (FIR) for nearly six months.
The Supreme Court agreed to examine the company's plea for a central investigation and issued notice in August 2026.
The case brought renewed attention to the protection of medical and insurance records held by digital healthcare platforms. Such information can reveal details about individuals' health, financial circumstances and insurance claims, making its unauthorised disclosure particularly sensitive.
The allegations also highlighted concerns about the response to reported cybercrime incidents, including the time taken to register complaints and initiate investigations.
Cybersecurity risks across sectors
The five incidents illustrate different vulnerabilities in India's digital ecosystem, ranging from weaknesses in cryptographic key generation to the exposure of banking records, compromised employee accounts, third-party infrastructure risks and alleged theft of sensitive healthcare information.
Their reported impact varies considerably. The digital certificate incident raised concerns about the potential misuse of authentication systems to undermine trust in websites and software. The banking incidents involved reported exposures of customer information and internal documents, while the healthcare case centred on allegations concerning sensitive medical and insurance records.
The incident involving files allegedly connected to a nuclear power plant, meanwhile, highlighted the need to distinguish verified breaches from claims made by ransomware groups, particularly when the material is said to be linked to strategically important infrastructure.
Across these cases, effective cybersecurity requires secure system design, robust access controls, reliable monitoring, independent investigations and prompt responses to suspected breaches. Organisations also need to assess the security of their contractors and technology providers, rather than focusing exclusively on their own internal systems.
As banks, healthcare platforms and businesses increasingly depend on digital infrastructure, the protection of personal information and the integrity of authentication systems remain critical to maintaining public trust.