Stock crash alert! eMudhra shares plunge 37% in just two sessions. What’s unfolding?

ETMarkets.com

The latest fall follows a 20% drop on Wednesday after the Indian Computer Emergency Response Team (CERT-In), the Centre’s nodal cybersecurity agency, issued an urgent advisory following a critical security incident involving eMudhra. The company reported a compromise of private keys linked to eight intermediate Certificate Authority (CA) certificates.

In a series of posts on X, the Ministry of Electronics and Information Technology (MeitY) said it had taken serious note of the incident and was working with stakeholders to address the issue. It added that eMudhra’s Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY, remain unaffected.

“The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” the ministry said.

MeitY said eMudhra operates across two distinct businesses. One covers digital signature and eSign services regulated by the CCA, while the other provides digital certificates trusted by major browsers and operating systems to secure websites, software and online communications.

The incident is confined to the latter business, which operates internationally under a global trust framework and is subject to independent audits, including WebTrust audits by BDO International. MeitY said it does not audit this part of eMudhra’s operations.

The eight affected certificates were issued under eMudhra’s global Public Key Infrastructure (PKI), which establishes trust in digital certificates and secures online connections.

eMudhra responds

“A flaw in the Key Generation Ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause,” it said in a regulatory filing.

These roots and issuing CAs have gone through independent audits for two years in a row, and have been in browser trust lists since mid 2025. Last weekend, an independent researcher found that the weak keys could be reverse-engineered, possibly with AI-assisted techniques. The researcher reported this to the major root programs: Apple, Google, Microsoft and Mozilla.

eMudhra said the incident has no impact on its Indian Digital Signature Certificate (DSC) and eSign businesses, which operate on infrastructure separate from its global Transport Layer Security (TLS) business. Its DSC and eSign services in India continue to operate normally.

The affected global TLS business accounts for around 1% of eMudhra’s revenue, limiting the potential commercial impact. However, the company said the incident could pose reputational risks, the extent of which cannot be quantified.

“eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation,” it added.