Stock crash alert! eMudhra shares plunge 37% in just two sessions. What’s unfolding?

Shares of Indian digital trust and cybersecurity firm eMudhra fell another 20% to an intraday low of Rs 345, extending losses for a second consecutive session and taking the decline to around 37% over the period.

The latest fall follows a 20% drop on Wednesday after the Indian Computer Emergency Response Team (CERT-In), the Centre’s nodal cybersecurity agency, issued an urgent advisory following a critical security incident involving eMudhra. The company reported a compromise of private keys linked to eight intermediate Certificate Authority (CA) certificates.

In a series of posts on X, the Ministry of Electronics and Information Technology (MeitY) said it had taken serious note of the incident and was working with stakeholders to address the issue. It added that eMudhra’s Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY, remain unaffected.


“The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” the ministry said.

MeitY said eMudhra operates across two distinct businesses. One covers digital signature and eSign services regulated by the CCA, while the other provides digital certificates trusted by major browsers and operating systems to secure websites, software and online communications.

The incident is confined to the latter business, which operates internationally under a global trust framework and is subject to independent audits, including WebTrust audits by BDO International. MeitY said it does not audit this part of eMudhra’s operations.

Also read: Adani Green Energy shares fall 4% after Q2 results. What are Jefferies, JM Financial saying?

The eight affected certificates were issued under eMudhra’s global Public Key Infrastructure (PKI), which establishes trust in digital certificates and secures online connections.

eMudhra responds

“A flaw in the Key Generation Ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause,” it said in a regulatory filing.

These roots and issuing CAs have gone through independent audits for two years in a row, and have been in browser trust lists since mid 2025. Last weekend, an independent researcher found that the weak keys could be reverse-engineered, possibly with AI-assisted techniques. The researcher reported this to the major root programs: Apple, Google, Microsoft and Mozilla.

eMudhra said the incident has no impact on its Indian Digital Signature Certificate (DSC) and eSign businesses, which operate on infrastructure separate from its global Transport Layer Security (TLS) business. Its DSC and eSign services in India continue to operate normally.

Also read: Deepinder Goyal’s Dark.ai could be Eternal’s dark horse, but is it too early to bet?

The affected global TLS business accounts for around 1% of eMudhra’s revenue, limiting the potential commercial impact. However, the company said the incident could pose reputational risks, the extent of which cannot be quantified.

“eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation,” it added.

Disclaimer: This article has been written by Veer Sharma, who is not a SEBI-registered Research Analyst or an Investment Adviser. Veer Sharma and his/her ‘relative(s)’ (as defined under Section 2(77) of the Companies Act, 2013) do not hold any financial interest in the companies mentioned in this article as of the date of publication. The views/recommendations mentioned in this article, wherever applicable, are those of the respective SEBI-registered Research Analyst/brokerage and have been reproduced/reported with due attribution. They should not be construed as the views or recommendations of The Economic Times Digital or the journalist. Readers are advised to consider the original research report and make their investment decisions based on their own assessment. Brokerage disclaimers here.