eMudhra Shares Crash 13% on Cybersecurity Flaw; Here's What Investors Should Watch Next
Shares of eMudhra Limited fell 13% amid concerns over compromised private keys associated with eight intermediate Certificate Authorities (CAs) in its global certificate business. The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the incident, while CERT-In has issued an advisory outlining potential cybersecurity risks. eMudhra Limited shares traded around ₹ 373.60 per share on October 22, 2026, down 13% with a market capitalisation of approximately ₹3,574 crore. The stock's 52-week range stood at around ₹365–₹688, while its trailing P/E ratio was approximately 31x.
Also Read: Sensex & Nifty 50 | Stock Market Live Updates Today: Sensex, Nifty Fall Nearly 1% as Metal and Auto Stocks Lead Losses
Cryptographic Flaw Compromises Digital Certificate Keys
According to eMudhra’s statement, eight intermediate CAs in their certificate issuance business were affected by the event. These certificates were issued after a key generation ceremony that took place on April 30, 2025, using the FIPS 140-2 Level 3 Hardware Security Modules.
The issue in the key generation procedure resulted in weak keys along with the existing strong keys. The weak keys were then disclosed in the browser root stores. The affected certificates include six TLS certificates and two code-signing certificates.
CERT-In Warns of Potential Cybersecurity Threats
CERT-In has pointed out that the affected private keys might be abused by the attacker to forge certificates for domains that the attacker does not own. These certificates may allow the website to be spoofed or may help the attacker carry out man-in-the-middle attacks. Apart from website authentication, the code-signing private keys may be abused to issue forged certificates for code signing.
MeitY Launches Investigation
MeitY has noted the development and has set up a team to look into the matter. MeitY has also warned against social media accounts raising fear about the consequences of the incident.
According to government sources, the effect on Indian websites and apps was not supposed to be major, as the certificate operation for the rest of the world is different from eMudhra's Indian digital signatures and eSigns.
Also Read: Ace Software Exports acquires Shopify app developer QeApps for ₹12 Cr using rights issue proceeds
Google and Mozilla Take Mitigation Measures
Browser operators have moved to contain the risks associated with the affected certificates. Google blocked the public keys of the affected TLS intermediate certificates in Chrome through a Certificate Revocation List Set (CRLSet) update. Google also announced the removal of eMudhra's eSign ECC Root CA-G3 from the Chrome Root Store, with the change scheduled to roll out to devices relying on the Chrome Root Store.
Mozilla has also blocked the six affected TLS intermediate certificates issued by eMudhra. These measures are intended to reduce the risk of affected certificates being trusted by browsers.
Limited Revenue Exposure, but Reputational Risks Remain
eMudhra said that its impacted global TLS business accounts for about 1% of overall income. The firm said that the Indian DSC and eSign businesses have not been impacted and continue to function normally.
The company also said that there was no security breach on its side, its infrastructure was intact, and there was no security breach of any kind. However, the company admitted that it would be impossible to quantify its impact on reputation. Investigation into Replacement of Certificates and Root Cause is Ongoing.
It has come to light through reports that an independent security researcher had flagged that the weak key pair can be reverse engineered using artificial intelligence.
eMudhra is cooperating with affected clients in replacing their certificates and ensuring that no disruptions happen in their critical services.
What Should Investors Watch Next?
In the short term, the emphasis will be on the results of the investigation, ways to get new certificates, and regulation along with the possible effects on customer confidence. Despite the fact that the company represents only about 1% of revenues, the risks may have an effect that goes beyond that company's operations.
Also Read: Persistent Systems opens ₹4,265 Crore QIP to fund Nagarro acquisition as Q2 FY27 net profit dips 25.4% YoY to ₹351.51 Cr
eMudhra was founded in 2008 and based in Bengaluru. It offers digital identity, digital signatures, SSL/TLS certificates, identity management, and cybersecurity services worldwide. The long-term effect on finances is unknown. The investors should pay attention to company announcements and regulation news in order to separate revenue risks from reputational risks.