Context:

Recently, in October 2026, several cybersecurity incidents targeting India's digital infrastructure came to light simultaneously, shaking the foundations of the country's digital sovereignty, national security and financial ecosystem. The leakage of encryption private keys associated with eMudhra, a national digital certification authority, and the exposure of customer data belonging to the country's largest public sector bank, the State Bank of India (SBI), on the dark web are not merely two separate technical incidents. They highlight significant gaps in the internal security and regulatory framework of India's Digital India initiative.

In a digital economy, cybersecurity is not merely a matter of technical arrangements; it is closely linked to national security, economic stability, citizens' privacy and public trust in digital governance.

Growing Importance of Digital Transformation and Cybersecurity

Over the past few years, India has made remarkable progress in the field of Digital Public Infrastructure (DPI). Aadhaar, UPI, digital banking, DigiLocker, online government services and e-commerce have made interactions between citizens and the government more convenient.

This transformation has promoted financial inclusion, improved access to services and enhanced administrative efficiency. However, as more services become dependent on the internet, the potential impact of cyberattacks is also increasing.

Therefore, the success of digital development should not be assessed solely on the basis of the number of online services available, but also in terms of their security, reliability and ability to continue functioning during a crisis.

eMudhra Incident: Digital Trust Chain and Encryption

In cybersecurity, Public Key Infrastructure (PKI) forms the foundation of digital trust. HTTPS and TLS certificates play an important role in establishing secure communication between websites and users and verifying website identities. Organisations that issue these certificates are known as Certificate Authorities (CAs). In India, the Controller of Certifying Authorities (CCA) plays an important role in regulating certification authorities and the digital certificate framework.

According to reports that emerged in October 2026, insufficient cryptographic randomness was identified in the generation of private keys associated with eight intermediate Certificate Authority certificates linked to eMudhra. Such a weakness can create the risk of private keys being guessed or recovered. If these keys are misused, attackers may attempt to create fraudulent digital certificates, impersonate websites or compromise the reliability of secure communications.

This incident makes it clear that the security of organisations issuing digital certificates is not merely a technical issue; it is a matter of trust across the entire digital ecosystem. It is essential to strengthen the secure generation, storage and use of private keys, independent security audits and mechanisms for timely certificate revocation.

SBI Incident: Data Privacy and Financial Security

According to a report dated October 21, 2026, the bank initiated an investigation into an incident involving the leakage of customer data. Preliminary information mentioned the leakage of records relating to 3,897 customers. The bank also stated that an independent cybersecurity agency would investigate the incident.

It is important to understand the relationship between the dark web and data breaches. The dark web is a part of the internet where access to certain services requires specialised software or networks. Although it can also be used for legitimate privacy-related purposes, it is frequently associated with the trade in stolen data and cybercrime.

The exposure of customers' personal information can create several risks:

• Phishing: Criminals may impersonate bank officials and ask customers to share OTPs, passwords or other confidential information.
• Identity Theft: Personal details may be used to create fake identities or facilitate fraudulent activities.
• Targeted Financial Fraud: Actual customer information may be used to send fraudulent messages that appear more convincing and trustworthy.
• Loss of Trust: Citizens' confidence in the banking system may weaken.

Banking security should not be evaluated solely on the basis of the security of accounts and transactions, but also on the basis of the protection of customers' personal information.

Major Cybersecurity Challenges in India:

1. Technological Dependence and Weak Security Standards: Many organisations continue to rely on outdated software, weak passwords, insecure configurations and inadequate security testing.

2. Supply Chain-Related Risks: A security lapse at a single service provider or software company can affect numerous clients. Therefore, securing an organisation's own systems alone is not sufficient.

3. Lack of Institutional Accountability: In many cases, security breaches are detected after a delay. This can increase the extent of the damage and make it difficult to alert affected citizens in a timely manner.

4. Need for Skilled Professionals: Trained human resources, modern technological tools and regular training are not equally available across all institutions in the field of cybersecurity.

5. Cross-Border Cybercrime: Cybercriminals, their servers and stolen data may be located in different countries. This creates difficulties in investigations, evidence collection and legal action.

Legal and Institutional Framework for Cybersecurity in India:

• Information Technology Act, 2000: Provides the principal legal foundation for addressing cybercrimes and matters related to the security of digital systems.
• CERT-In: The Indian Computer Emergency Response Team is the national agency responsible for responding to cybersecurity incidents, issuing alerts and facilitating coordination.
• NCIIPC: The National Critical Information Infrastructure Protection Centre focuses on protecting information infrastructure in critical sectors such as energy, banking, telecommunications and other essential services.
• Digital Personal Data Protection Act, 2023: Provides a legal framework for the processing of digital personal data and the accountability of data fiduciaries.
• National Cyber Coordination Centre (NCCC): Assists in identifying cyber threats and coordinating among relevant agencies.

The government has also promoted cybersecurity awareness and protection against malicious software through initiatives such as the Cyber Swachhta Kendra.

However, the mere existence of laws and institutional frameworks does not automatically ensure effective security. Their successful implementation requires regular audits, timely action, trained personnel and mechanisms to establish accountability.

Way Forward:

India must accord cybersecurity the same priority as digital development. The following measures are essential:

Security by Design: Security should be incorporated into the fundamental architecture of a digital service during its development, rather than being added as an additional measure after a problem arises.

Regular Security Audits: Government websites, banks, certificate-issuing organisations and digital service providers should undergo independent technical assessments. The generation, storage and use of cryptographic keys should also be reviewed regularly.

Timely Notification and Response: In the event of a data breach, affected organisations should assess the severity of the incident and notify the relevant agencies and affected individuals within the prescribed time limits.

Clear Rules for the Safe Use of AI: AI-based tools should be granted only the minimum permissions necessary to perform their functions. Their activities should be logged, access to sensitive data should be restricted, and appropriate human oversight should be ensured before any significant action is taken.

Data Minimisation: Organisations should collect only the amount of personal data necessary for a legitimate purpose. This can reduce the potential damage in the event of a data breach.

Public Awareness: Citizens should be encouraged to avoid unfamiliar links, adopt multi-factor authentication, never share OTPs and immediately report suspicious banking activities.

Self-Reliance in Cybersecurity: Indigenous cybersecurity solutions, research, professional training and public-private partnerships should be promoted. At the same time, global standards and international cooperation must also be given due importance.

Conclusion:

The future of Digital India depends not only on technological innovation and widespread internet access but also on how secure citizens feel about their personal information, financial transactions and digital services.

The certificate security vulnerability associated with eMudhra, the investigation into the leakage of SBI customer records and the growing technological capabilities of AI are separate developments. However, they convey a common message: security, transparency and accountability must be accorded the highest priority to maintain trust in the digital ecosystem.

India must develop a cybersecurity framework that does not merely respond after attacks occur but identifies potential threats in advance, limits the damage and restores normal operations quickly after a crisis. This will form the foundation of a secure, inclusive and trustworthy Digital India.