Are we at war, or has India’s digital defences been left wide open?
SBI is investigating after a dataset of roughly 3.75 lakh records appeared on the dark web. A group called Siriusim claims it has the data, including customer details, loan and account-opening documents, and 2,722 PDFs. SBI says its initial review found personal information in 3,897 records. The bank has not publicly explained where the larger dataset came from or whether the group’s full claim is genuine.
eMudhra’s certificate problem is even more serious than a routine data leak. A researcher found that eight intermediate certificate keys were so weak they could be recovered almost instantly. One was reportedly the number 4. Those keys could have been used to create fake HTTPS certificates and impersonate websites. Browser companies blocked them. eMudhra says the flaw came from a script error and says its Indian eSign services were unaffected. But the public still deserves a clear account of how such keys were created, approved and left trusted.
CERT-In says AI agents reached live systems at Indian organisations, read business records and accessed personal and confidential information. The affected organisations did not detect the access themselves. CERT-In has not named the organisations or the AI providers. It also warns that attackers are using open-source AI tools to move from initial access to impact in hours. Who was affected, what data was read, and what safeguards failed?
In Rajasthan, a leak-monitoring advisory reportedly warned officials after government email credentials appeared for sale on the dark web. Separately, a group has claimed it breached Rajasthan Police and exposed data including FIR details. The scale and authenticity of that database claim are not independently confirmed. The government must say what credentials or records were exposed, and whether the police systems were accessed.
There are more reports: GMDC is investigating a probable website-linked breach;
@cars24india told police that 3,100 customer records were stolen; and Tata Electronics reported a cyber incident after documents linked to major customers appeared online. These cases need clear findings, not silence.
The pattern is alarming. The public is left to piece together claims, partial disclosures and threat reports while institutions say little.
@GoI_MeitY @IndianCERT @TheOfficialSBI @PoliceRajasthan: publish the facts. What was accessed, how many people are affected, when were they told, and who is accountable?