From eMudhra to Bank of Baroda: 5 major data breaches in recent times

A security flaw at Bengaluru-based digital certificate provider—eMudhra Ltd.—put global web security at risk after weak cryptographic keys linked to eight certificates prompted Google, Mozilla, Apple and Microsoft to take “emergency action”.

The keys could potentially have allowed attackers to create fraudulent certificates for websites and software, raising concerns about the security of systems that rely on digital authentication.

The incident is among several major cybersecurity breaches and data exposures involving Indian organisations in recent years, affecting sectors ranging from banking and healthcare to technology and infrastructure. While some incidents involved customer information appearing on the dark web, others exposed sensitive corporate records or raised concerns about the security of digital systems.

Here is a look at five recent data breaches and significant cybersecurity incidents linked to India:

eMudhra: Weak cryptographic keys put global web security at risk

eMudhra’s security incident came to light in October 2026, after a researcher identified weaknesses in private keys associated with eight intermediate certificates issued by the Bengaluru-based company.

The weak keys were eMudhra’s own doing. In its replies to Mozilla, the company said its staff used them by mistake at a key generation ceremony in April 2025 and that “there were human errors in multiple steps of the process”.

The private keys were meant to be sufficiently complex to prevent anyone from deriving them from the corresponding public keys. However, the affected keys were numbers that could be recovered by testing a small range of possibilities. This meant that attackers could use them to issue fraudulent certificates, impersonate websites, or sign software as though it came from a verified publisher.

Google, Mozilla, Apple and Microsoft took steps to block the affected certificates. “As this incident enables even technically unsophisticated individuals to easily recover the private keys for these intermediates, the impact of this incident could not be higher,” Mozilla wrote in its incident report.

eMudhra said its infrastructure was not compromised and no data was breached. It said its Indian digital signature certificate and eSign businesses run on separate infrastructure and were unaffected.

State Bank of India: 3,897 customer records identified in suspected Data Exposure

The State Bank of India (SBI) on October 21, 2026, informed the Bombay Stock Exchange and the National Stock Exchange that it had suffered “an incident involving the loss of certain data,” with 3,897 customer records containing personal information identified within a larger trove of about 3.75 lakh records on the dark web.

The exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF (Customer Information File) identifiers, lead IDs, and metadata linked to loan records and other files. The bank said it learnt of the incident on October 16 through its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

SBI activated its incident-response protocols and engaged an independent CERT-In-empanelled agency to establish the authenticity, source and extent of the exposure. It said the incident was not expected to have a material impact on its core operations, financial performance or business continuity.

The bank’s disclosure did not establish how the data had left its systems or what the remaining records in the larger dataset contained. The investigation is ongoing, and the full number of individuals potentially affected remains unclear.

Bank of Baroda: Customer information and internal documents appear on dark web

Bank of Baroda confirmed a cybersecurity incident on July 27, 2026, after customer information and internal documents allegedly linked to the lender appeared on the dark web. The bank said the incident involved a compromised employee email account, resulting in unauthorised access to certain data.

Cybersecurity researcher Srikanth L said the leaked material included customer details, identification documents, loan papers and internal audit records. The dataset was advertised on a dark-web site as containing more than 700GB of information, based on an analysis of the site’s metadata. The full volume and authenticity of the material were not independently established.

The bank said the incident had been identified promptly and that containment measures had been implemented. It also said its core banking systems had not been accessed and remained secure. Bank of Baroda initiated a forensic investigation and said it was working with the relevant authorities.

Reliance Group: Files linked to Kudankulam Nuclear Plant published online

In July 2026, a ransomware group published files it claimed were linked to the Kudankulam Nuclear Power Plant in Tamil Nadu. The material reportedly included facility-related documents, supplier details and information about infrastructure systems.

Reliance Group confirmed a partial data breach involving a server hosted by Indian data centre provider Yotta and said that the government had been informed. The group behind the leak claimed that the files were connected to the nuclear plant, but the authenticity and full scope of the material required careful verification.

The incident drew attention to cybersecurity risks associated with third-party data storage and contractors working with strategically important infrastructure. The case highlighted the potential consequences of unauthorised access to corporate systems that hold information related to critical infrastructure.

Vitraya Technologies: Alleged exposure of medical and insurance records

Vitraya Technologies—which operates a digital platform for health insurance claims— approached the Supreme Court in 2026 seeking a CBI probe into the alleged hacking and theft of personal and medical data of more than 1.5 lakh citizens stored by the company

The petition filed by the company alleged a large-scale cyber intrusion involving unauthorised access to highly sensitive personal information, including medical records, insurance claim details, Aadhaar-linked information, and other personally identifiable data. Vitraya detected a coordinated cyberattack in February 2025 involving brute-force login attempts, mass downloading of confidential records, and the extraction of sensitive customer data from its digital infrastructure.

Vitraya also alleged that it approached Punjab’s cybercrime police in March 2025. However, despite repeated representations and full cooperation during the preliminary inquiry, the police allegedly delayed registering an FIR for nearly six months. The Supreme Court agreed to examine the plea for a central investigation and issued notice in August 2026.

The case highlighted concerns over the protection of sensitive medical and insurance information held by digital healthcare platforms, where unauthorised access can expose details about individuals’ health and financial circumstances.