diff --git a/CHANGELOG-roots.md b/CHANGELOG-roots.md
index f71a572..a403312 100644
--- a/CHANGELOG-roots.md
+++ b/CHANGELOG-roots.md
@@ -43,8 +43,25 @@ it to `*.disabled`.
 
 Rationale: on 2026-10-17 the private keys of eight eMudhra intermediate CA
 certificates were reported to the root programs as compromised. The reporter
-proved it by signing a test message with each key. These intermediates chain to
-this root. Mozilla blocked them through OneCRL and is removing the root in
+proved it by signing a test message with each key. The keys were not stolen:
+eMudhra generated them badly. Each intermediate's P-384 private scalar is a tiny
+integer, so anyone can recover it by computing `k·G` for small `k` and comparing
+the result with the certificate's public key:
+
+| Intermediate | Private key |
+|---|---|
+| EM OV TLS CA - G3C | 4 |
+| EM EV TLS CA - G3C | 56 |
+| EM OV CS CA - G3B | 66 |
+| EM EV TLS CA - G3B | 115 |
+| EM OV TLS CA - G3B | 155 |
+| EM DV TLS CA - G3B | 156 |
+| EM DV TLS CA - G3C | 230 |
+| EM OV CS CA - G3C | 237 |
+
+We checked each value against the public keys in the incident's
+`impacted-intermediates.json`. The keys date back to issuance (April 2025), so
+the intermediates were never secure. These intermediates chain to this root. Mozilla blocked them through OneCRL and is removing the root in
 NSS 3.131.1. Chrome blocked them with a CRLSet and is removing the root in Chrome
 Root Store version 43. Apple and Microsoft acted on 2026-10-19 and 2026-10-20.
 `cacrt` has no revocation channel of its own, so we follow Mozilla's guidance for
diff --git a/roots/eMudhra/README.md b/roots/eMudhra/README.md
index 7254c11..75f2c29 100644
--- a/roots/eMudhra/README.md
+++ b/roots/eMudhra/README.md
@@ -37,7 +37,7 @@ eMudhra's certificates are logged to publicly operated Certificate Transparency
 
 ## Past non-compliance
 
-**Intermediate key compromise (October 2026):** The private keys of eight eMudhra intermediate CA certificates, chaining to emSign ECC Root CA - G3, were compromised. A reporter proved this to the root programs on 2026-10-17 by signing a test message with each key. Firefox and Chrome blocked the intermediates the same day, Apple on 2026-10-19 and Microsoft on 2026-10-20. Mozilla (NSS 3.131.1) and Chrome (Root Store v43) are removing the root. [[Mozilla Security Blog]](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) [[dev-security-policy thread]](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ)
+**Intermediate key compromise (October 2026):** The private keys of eight eMudhra intermediate CA certificates, chaining to emSign ECC Root CA - G3, were compromised. A reporter proved this to the root programs on 2026-10-17 by signing a test message with each key. The root cause was key generation: each intermediate's P-384 private key is a tiny integer (4, 56, 66, 115, 155, 156, 230 and 237), recoverable by anyone in a fraction of a second, so the intermediates were insecure from issuance in April 2025. Firefox and Chrome blocked the intermediates the same day, Apple on 2026-10-19 and Microsoft on 2026-10-20. Mozilla (NSS 3.131.1) and Chrome (Root Store v43) are removing the root. [[Mozilla Security Blog]](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) [[dev-security-policy thread]](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ)
 
 Before this, three compliance incidents have been documented in Mozilla Bugzilla: