From eMudhra To SBI, Reliance: 5 Major Data Breaches That Exposed India’s Digital Fault Lines

The cybersecurity flaw identified in eMudhra’s digital certificate infrastructure is the latest incident to raise questions about the security of sensitive data and the systems that protect it. The discovery prompted major technology companies to block affected certificates, while eMudhra said its infrastructure had not been compromised and that its India-focused digital signature and eSign services remained unaffected.

The incident comes amid a series of cybersecurity disclosures and alleged data leaks involving banks, corporate networks and sensitive personal records. From customer information appearing in datasets circulated on the dark web to allegations of large-scale theft of medical data, these cases highlight the different ways digital security failures can expose individuals and institutions to risk.

Why Data Breaches Matter

A data breach occurs when sensitive, confidential or protected information is accessed, disclosed, stolen or exposed without authorisation. Such incidents can result from cyberattacks, compromised employee accounts, software vulnerabilities or weaknesses in how information is stored and protected. Not every cybersecurity incident involves the theft of personal data, and claims of a breach do not always establish the full scale or nature of the exposure.

The consequences can extend beyond the immediate compromise of a system. Exposed personal information may be used for identity theft, fraud or targeted scams, while the disclosure of business records and internal documents can create financial, legal and reputational risks. Where the data involves financial services, healthcare or critical infrastructure, the potential impact can be particularly serious.

The five incidents below illustrate different aspects of that risk. They vary in what has been confirmed, what organisations have disclosed and what remains alleged or unverified.

eMudhra: Cryptographic Flaw Puts Website Security At Risk

The eMudhra incident came to light in October 2026, after an independent security researcher identified weaknesses in private keys associated with eight intermediate Certificate Authorities (CAs) used by the Bengaluru-based company’s global TLS business.

Digital certificates help establish secure connections between websites and users by verifying a website’s identity. The private keys associated with these certificates are intended to be sufficiently complex to prevent attackers from deriving them and creating fraudulent certificates.

In eMudhra’s case, weak keys generated during a key-generation ceremony on April 30, 2025, could potentially be recovered and used to issue fraudulent digital certificates. Such certificates could allow attackers to impersonate legitimate websites or sign software as though it came from a trusted publisher.

In its responses to Mozilla, the company acknowledged human errors during the key-generation process, saying “there were human errors in multiple steps of the process”.

Google, Mozilla, Apple and Microsoft took steps to block the affected certificates. Mozilla warned that the ease with which the private keys could be recovered significantly increased the potential impact of the incident.

eMudhra has said its infrastructure was not compromised and no data was breached. It also clarified that its Indian Digital Signature Certificate and eSign businesses, which operate on separate infrastructure, were unaffected. The company said its global TLS business accounts for around one per cent of its revenue.

However, the incident has raised questions about certificate issuance procedures, security controls and the reputational risks facing companies that provide digital trust services.

State Bank Of India: 3,897 Customer Records Identified

SBI disclosed an incident involving the loss of certain data to stock exchanges on October 21, 2026, after 3,897 customer records containing personal information were identified within a larger dataset of approximately 3.75 lakh records found on the dark web.

The bank said it became aware of the incident on October 16 through its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

The exposed information reportedly included customers’ names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch details and Customer Information File (CIF) identifiers. Metadata associated with loan records and other files was also reportedly present.

SBI activated its incident-response protocols and engaged an independent CERT-In-empanelled agency to determine the authenticity, source and extent of the exposure.

The bank said the incident was not expected to have a material impact on its core operations, financial performance or business continuity.

However, the disclosure did not establish how the information had left the bank’s systems or what the remaining records in the larger dataset contained. The investigation is ongoing, and the total number of individuals potentially affected remains unclear.

Bank Of Baroda: Customer Information Appears On Dark Web

Bank of Baroda confirmed a cybersecurity incident on July 27, 2026, after customer information and internal documents allegedly linked to the lender appeared on the dark web.

The bank said the incident involved a compromised employee email account, resulting in unauthorised access to certain data. Cybersecurity researcher Srikanth L reported that the material included customer details, identification documents, loan papers and internal audit records.

The dataset was advertised on a dark-web platform as containing more than 700GB of information, based on an analysis of the site’s metadata. However, the full volume and authenticity of the material were not independently established.

Bank of Baroda said it had identified the incident promptly and implemented containment measures. It maintained that its core banking systems had not been accessed and remained secure.

The lender also initiated a forensic investigation and said it was working with the relevant authorities.

The incident highlighted how compromised employee accounts can become a route for unauthorised access to sensitive information, even when a bank’s core systems are not affected.

Reliance Group: Ransomware Claims Involving Nuclear Plant Documents

In July 2026, a ransomware group published files it claimed were linked to the Kudankulam Nuclear Power Plant in Tamil Nadu. The material reportedly included facility-related documents, supplier details and information about infrastructure systems.

Reliance Group separately confirmed a partial data breach involving a server hosted by Indian data centre provider Yotta and said the government had been informed.

The group behind the online leak claimed the published files were connected to the nuclear plant. However, the authenticity of the material and the extent of any connection to the facility required careful verification.

The available information does not establish that the publication of the files and the breach confirmed by Reliance Group involved the same systems or incident. Nor does it establish that the nuclear plant itself was compromised.

The episode nevertheless drew attention to cybersecurity risks associated with third-party data storage and the handling of information connected to strategically important infrastructure.

Organisations increasingly depend on external data centres, service providers and contractors to store and process information. A security incident involving one part of that network can raise concerns about the confidentiality of data held beyond an organisation’s immediate systems.

Vitraya Technologies: Alleged Theft Of Medical And Insurance Records

Vitraya Technologies, which operates a digital platform for health insurance claims, approached the Supreme Court in 2026 seeking a Central Bureau of Investigation (CBI) probe into the alleged hacking and theft of personal and medical data belonging to more than 1.5 lakh citizens.

In its petition, the company alleged that a coordinated cyberattack in February 2025 involved brute-force login attempts, mass downloading of confidential records and the extraction of sensitive information from its digital infrastructure.

The allegedly exposed information included medical records, insurance claim details, Aadhaar-linked information and other personally identifiable data.

Vitraya also alleged that it approached Punjab’s cybercrime police in March 2025 but faced delays in the registration of an FIR despite repeated representations and cooperation during a preliminary inquiry.

The Supreme Court agreed to examine the plea and issued notice in August 2026.

The allegations have raised concerns about the protection of sensitive information held by digital healthcare and insurance platforms. Unlike the exposure of ordinary contact details, the unauthorised disclosure of medical records can reveal intimate information about a person’s health, treatment and financial circumstances.

The case also highlights the importance of timely investigation and clear accountability when organisations report alleged cyber intrusions involving sensitive personal information.