- Engineer — Act: Eight intermediate CA private keys were actually recovered — any certificate signed by those intermediates should be treated as potentially compromised. Audit your certificate inventory for eMudhra-issued certs and replace them now, before major browsers revoke trust and cause outages.
- SOC/IR — Plan: Compromised intermediate CA keys enable forged certificates for MITM attacks. Update TLS inspection rules to flag or alert on eMudhra-signed certificates in your environment, and confirm that CA distrust events are reflected in your trust stores and monitoring.
- Leader — Act: A CA with recovered intermediate private keys will face browser distrust, which turns unexpired certificates into outages. Confirm this quarter whether your organization holds any eMudhra-issued certificates and initiate replacement before the distrust wave hits — and check if any vendors in your supply chain rely on them.