eMudhra shares fell nearly 20% to close at ₹345.25 on October 22, 2026, after the Indian government announced a special team to investigate a security incident at the digital certification company. The scrutiny concerns weak cryptographic keys issued for eight intermediate certificate authorities in its global business.
Key Takeaways
- The stock lost 34% over three consecutive sessions, wiping out more than ₹1,300 crore in market value.
- eMudhra said the affected global TLS business accounts for around 1% of revenue, but acknowledged unquantifiable reputational risks.
- The company said its Indian digital signature and eSign services remain unaffected, with no infrastructure compromise or data breach.
Table of Contents
- eMudhra shares fall as government scrutiny intensifies
- How the weak keys entered browser trust stores
- Domestic services remain separate from affected business
- Security incident follows a year of business growth
- Conclusion
eMudhra shares fall as government scrutiny intensifies
The October 22 sell-off left the Bengaluru-based company with a market capitalisation of around ₹2,695 crore, compared with approximately ₹4,000 crore before the three-session decline.
The investigation puts the reliability of eMudhra’s certificate-issuing process under scrutiny. Digital certificates help establish trust in online identities and communications, making the integrity of the keys behind them central to the service.
The direct revenue exposure disclosed by the company is small relative to its overall business. That does not establish the eventual financial impact: eMudhra itself has acknowledged reputational risks that it cannot quantify.
| Item | Details |
|---|---|
| FY26 total income | ₹713.2 crore, up 35.1% year on year |
| FY26 net profit | ₹110 crore, up 26.2% year on year |
| Q1 FY27 enterprise-solutions growth | About 50% year on year |
| FY26 revenue outside India and North America | Europe 12%; Middle East and Africa 11%; Asia-Pacific 7% |
How the weak keys entered browser trust stores
In its October 21 statement on the certificate incident, eMudhra said the eight affected intermediate certificate authorities were created during a key-generation ceremony on April 30, 2025. A flaw in a wrap-and-unwrap step produced a second set of weak keys alongside the original strong keys; the weak keys were subsequently published to browser root stores.
The company said an independent researcher discovered that the weak keys could be reverse-engineered and notified the root programs operated by Apple, Google, Microsoft and Mozilla. eMudhra was still working to establish the root cause when it issued its statement.
These disclosures describe a failure in key generation, rather than a confirmed intrusion into the company’s systems. eMudhra said its infrastructure had not been compromised, no data had been breached and its physical and logical security controls remained intact.
Domestic services remain separate from affected business
eMudhra said the affected global TLS business operates on infrastructure completely separate from its Indian Digital Signature Certificate and eSign businesses. Those domestic services were running normally, the company said.
The company was working with potentially affected customers to provide replacement certificates and avoid disruption to critical services. It was also coordinating with browser root programs while continuing its root-cause investigation.
The distinction matters because eMudhra’s operations extend beyond public digital certificates. Its enterprise products include digital-signature workflows, identity and access management, and certificate lifecycle management.
Security incident follows a year of business growth
The controversy comes after eMudhra reported growth in both total income and net profit for FY26. International revenue increased 38.7%, while enterprise solutions accounted for about 65% of revenue in the first quarter of FY27.
Its geographic reach also extends well beyond India. The company serves customers in more than 35 countries, and North America accounted for 34% of FY26 revenue, close to India’s 36% share.
Conclusion
The next developments to watch are the findings of the government investigation and eMudhra’s ongoing root-cause work. The disclosed revenue exposure is limited, but the extent of any reputational or customer impact remains unresolved.
Read More News
Disclaimer
This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.
