Within six days, four major cyber alerts related to digital infrastructure emerged. From SBI to the Rajasthan Police, eMudhra to PHP software, security weaknesses were found everywhere.
Cyber Emergency in India
If an unknown person calls you on your mobile phone and directly asks for your name, date of birth, home address, and the amount of your bank loan, it's natural for anyone to be shocked. Most people assume such calls are genuine calls from the bank. Cyber criminals exploit this trust and empty your bank accounts, sometimes under the guise of KYC updates or "digital arrest."
Four major cyber alerts related to digital infrastructure emerged in the country between October 16 and 21, 2026, within just six days. From the country's largest public sector bank, SBI, to the Rajasthan Police, eMudhra, a company that provides security for websites, and the PHP software that powers a large part of the internet, security weaknesses were visible everywhere. Opposition parties like Congress and Pawan Khera directly questioned the accountability of the central government and SBI. Meanwhile, numerous claims began to be made on social media, calling it a "global cyber emergency."
Six days and four major alerts: The full chain of events
The entire incident began on October 16, 2026, when the cyber intelligence monitoring account CyberPulse56 reported on X that a hacker named 'Siriussim' was claiming to be selling SBI data on the dark web. On the same day, SBI received official threat alerts from the Defense Cyber Agency (DCA), CERT-In, and its own Threat Intelligence Unit.
The very next day, on October 17th, an independent cybersecurity researcher alerted international browser companies to a serious technical flaw in the private keys of eight digital certificates of the Indian certifying company, eMudhra. Recognizing the severity of the situation, eMudhra, under the supervision of CERT-In, immediately revoked all eight affected certificates on October 18th.
Subsequently, on October 20th, two critical security flaws in PHP, the backend software that powers web servers worldwide, were disclosed ahead of schedule. On October 21st, SBI formally informed the stock exchanges that the personal records of 3,897 customers had been compromised. On the same day, a hacker group called "Scarlettgroup" claimed to have compromised Rajasthan Police data, while PHP released security patches and CERT-In issued a critical alert to all system administrators in India.
SBI data leak: Data of 3,897 customers on dark web raises more questions
A hacker on the dark web claimed to have access to approximately 3.75 lakh SBI records. The bank commissioned a forensic investigation by an independent cyber agency empanelled with CERT-In, which confirmed the leak of personally identifiable records (PII) of 3,897 customers. These records included customer names, mobile numbers, email addresses, dates of birth, gender, addresses, branches, customer identification numbers, and highly sensitive loan-related data.
Pawan Khera and the opposition's sharp questions: Who is accountable?
As the matter escalated, Congress leader Pawan Khera posted on social media, directly questioning the accountability of the bank and the central government. He asked why the country's largest financial institution didn't detect the leak of its customers' data through an internal audit and why it had to wait for an alert from external security agencies.
The opposition also raised the issue of whether the bank personally alerted the 3,897 customers whose personal data was exposed, either by phone or email, to alert them to their level of caution. This question is extremely serious from the customer's perspective, because unless a victim is aware that their personal information is at risk, they will be unable to take steps to protect themselves from financial fraud.
Rajasthan Police: Claim of theft of 70,000 records and its ground investigation
Meanwhile, a hacker group called "Scarlettgroup" claimed to have breached the Rajasthan Police database and stolen 6.63 GB of data. According to the hacker, this data included 70,000 identity records, approximately 59,460 mobile numbers, emails of senior police officers, digital copies of FIRs, e-KYC records, and witness statements related to cases.
Cybercrime tracker Ransomware.live has recorded this claim. However, technically, until the Rajasthan Police or an independent investigating agency officially confirms it, it will be considered a "false claim." Variations in the dates of incidents have also been observed on different trackers. If this claim proves true, it would become more than just a simple data breach, but a highly sensitive issue involving investigation confidentiality and witness protection.
eMudhra case: Digital identity key flaws and the reality of DSC
When a user visits a government portal or bank website on the Internet, the lock (HTTPS) and digital certificate displayed in the browser prove that the website is genuine and secure. eMudhra is India's leading certifying authority that issues these certificates. A security researcher found that the private keys of eight certificates issued by eMudhra were created using a very weak cryptographic process that was easy to decode. This posed a risk of people being deceived by fake websites that appear to be genuine.
Upon discovering the flaw, CERT-In immediately revoked all eight certificates. Google's security team also took action and decided to remove one of eMudhra's root certificates from the Chrome browser from October 27, 2026. This incident sparked fear among the public about whether their digital signatures were also at risk. The Ministry of Electronics and IT (MeitY) and eMudhra clarified the situation, stating that the technical issue was limited to TLS/SSL certificates provided to international websites. The entire infrastructure for Digital Signature Certificates (DSCs) and e-Signs used for tax, tender, and corporate compliance in India runs on separate servers and a separate security system, making them completely secure.
Global panic: Alerts in PHP, Japan and around the world
This cyber activity wasn't limited to India's borders; it also exposed several major flaws in software infrastructure around the world. Two extremely serious security flaws, with a severity score of 9.2, were found in the PHP code that runs on the backend of approximately 69 percent of the world's websites.
The US CISA, the UK, and Japan's national cybersecurity agencies issued strict instructions to website operators to immediately apply security patches or take their websites offline. Tech magazine WIRED also reported that hackers have exploited these vulnerabilities to target systems on a large scale. The situation in Japan became so critical that the finance and health ministries removed some of their important web pages as a precaution, while major institutions like MUFG Bank and JR West were forced to go into emergency maintenance mode.
Cloud service provider Onamae also had to take emergency measures for thousands of its customer servers after receiving a malware alert. Meanwhile, GitLab, the largest platform for software developers, revealed that a major flaw existed in all versions after 2014. Hackers secretly added a password-stealing virus to the Python package (PyPI) of LiteLLM, a tool downloaded millions of times each week by AI developers, and it was available to developers for about two hours.
Sensational claims on social media vs reality check
Following these back-to-back incidents, several sensational claims were made on social media platforms like X by tech influencer Taegun Lee (@TGletter), claiming that the entire world had been hit by a major global cyber attack within the past 48 hours. A closer examination of these claims reveals several misleading narratives.
The first major claim on social media was that eMudhra's private key was as simple as "4," rendering over 60 million issued certificates useless. Investigations revealed this claim to be completely misleading. While there was a significant mathematical randomness flaw in key generation, the flaw only existed in eight international web certificates, which have been revoked. The millions of digital signatures used by ordinary citizens of India are completely unaffected.
Another claim was that 69 percent of the world's websites had been hacked due to PHP, and the internet was on the verge of collapse. This claim is highly exaggerated. Serious flaws were indeed found in PHP, and security agencies issued alerts, but this does not mean that all sites were hacked. The risk is only on older servers that have not implemented the latest security updates.
The third claim was that the world had been attacked within 48 hours as part of a planned "global AI cyberattack." This claim is technically proven false. The SBI data leak, the Rajasthan Police claim, the eMudhra flaw, the GitLab bug, and the LiteLLM package incidents occurred at different times and were the result of different technical flaws. No international investigative agency has found any evidence linking them to a single attack.
The role of AI: A new security watchdog or a weapon for hackers?
The role of artificial intelligence (AI) has been a hot topic at the heart of all these incidents. The complex PHP security flaw was discovered not by humans but by AI tools from cybersecurity companies like Calif and Wiz. This was aided by security models from OpenAI's "Patch the Planet" program, which is designed to rapidly discover hidden security holes in software code. However, the other side of the coin is that cybercriminals are also now using automated AI tools to continuously scan the servers of large companies.
According to reports, hackers have used AI-powered tools to exploit vulnerabilities in over 1,200 websites and the systems of over 100 global companies, including John Deere and Cummins. This proves that while AI is proving to be a time-saving tool for security researchers, it is also serving as a sharp weapon in the hands of attackers.
DPDP law and protection of common citizens: What do the rules say?
India's Digital Personal Data Protection Act (DPDP Act) makes it legally mandatory for any bank, company, or government entity to immediately notify affected citizens and the Data Protection Board of any data breach. Violations of these regulations are punishable by hefty fines of up to ₹200 crore. However, the deadline for full implementation of the detailed regulations under this law is May 13, 2027.
This is why digital rights organizations like the Internet Freedom Foundation (IFF) have demanded that organizations immediately disclose the truth to affected customers, without waiting for legal enforcement. In such a situation, instead of panicking, ordinary citizens should be cautious in their digital habits.
Even if an unknown caller provides your full name, address, and exact loan installment details over the phone, don't immediately trust them and simply say you'll visit your bank branch to discuss the matter. Furthermore, never click on SMS links purporting to redeem reward points or update your PAN or KYC. Remember not to share your OTP, UPI PIN, or net banking password with anyone, as receiving money via UPI is never required.
Regularly monitor your bank account messages and emails, and immediately block your card in case of any suspicious transaction. If you suspect any cyber fraud, immediately call the national helpline number 1930 or file a complaint on the Ministry of Home Affairs' portal cybercrime.gov.in. While the emergence of four major cybersecurity incidents within six days does not indicate a war-like cyberattack or a formal cyber emergency in the country, this development certainly raises a serious alarm for India's entire digital ecosystem.
When basic services like banking, health, policing, and identity rely on digital networks, simply installing new servers is not enough; instead, conducting continuous security audits of the system, closely monitoring external vendors, and maintaining complete transparency with the common citizen in case of data leaks has become a paramount need.
