eMudhra extends fall; stock down 43% in five days, tanks 53% from Sep high

eMudhra's share price remained under pressure, falling 10% to a fresh 52-week low at ₹318 on the BSE in Monday's intraday deals.

eMudhra share price movement

 

Share price of eMudhra continued to remain under pressure, falling 10 per cent to a fresh 52-week low of ₹318 on the BSE in Monday’s intraday deals. In the past five trading days, the stock plunged 43 per cent after the company informed the stock exchanges of a security incident in its global Transport Layer Security (TLS) certificate business. 

 

The Ministry of Electronics and Information Technology (MeitY) formed a special team to investigate the leak of private keys associated with web security certificates issued by the company.

 

The stock price of the company more than halved or tanked 53 per cent from its previous month high of ₹677.50 touched on September 16, 2026.

 

 

At 11:04 AM, eMudhra quoted 9 per cent lower at ₹322.75, as compared to a 0.09 per cent gain in the BSE Sensex. The average trading volume at the counter jumped 1.5 times with a combined 2.08 million shares changing hands on the NSE and BSE. CHECK Stock Market LIVE Updates 

Why is eMudhra’s stock price under pressure?

 

On October 21, 2026, eMudhra informed the stock exchanges of a security incident in its global Transport Layer Security (TLS) certificate business. The incident involved eight intermediate Certificate Authorities (CAs) created at a key generation ceremony on April 30, 2025. 

 

According to the company, a flaw in that ceremony produced a weaker second set of cryptographic keys alongside the intended keys, and the weaker set was published to browser root stores. An independent researcher reported the matter to the major browser root programs on October 17, 2026. Google (Chrome) and Mozilla (Firefox) blocked the affected intermediates within hours, Apple and Microsoft blocked them subsequently, and eMudhra revoked the affected certificates. 

 

The Indian Computer Emergency Response Team (CERT-In) issued an advisory on the matter, and Google announced that it will remove the emSign ECC Root CA – G3 from the Chrome Root Store from October 27, 2026.

 

On October 22, 2026, eMudhra informed the exchanges that its board decided to voluntarily withdraw from the global SSL/TLS certificate business and focus on its core enterprise solutions and other trust services. The MeitY constituted a special team to investigate the incident. Check - TOP GAINERS NSE | TOP LOSERS NSE

 

ICRA flags regulatory and reputational risks after security breach

 

Credit rating agency ICRA retained its ratings for eMudhra after a security incident in its global website certificate business, but flagged potential reputational damage, regulatory uncertainty and risks to customer retention. In an update dated October 23, ICRA retained its ratings at [ICRA]A (Stable)/[ICRA]A1 on the company's ₹35 crore unallocated credit limits.

 

ICRA noted the event and will continue to monitor developments, the outcome of the regulatory review, the company's business momentum and order inflows in subsequent quarters.

 

eMudhra's businesses rest on the trust of its customers. ICRA's earlier rationale identified cyber security threats as a risk for the trust services business, and management itself acknowledged reputational risks that cannot be quantified. 

 

Though the management indicated that out of the Global business of 64 per cent about 35 per cent-40 per cent will not be affected by reputational spillover, how far the incident affects customer acquisition and retention in the enterprise solutions business and in overseas markets, which account for 64 per cent of revenue, especially among BFSI and Government clients, is yet to be seen, ICRA said in its rating rationale.

 

Though Government officials indicated that the impact on Indian websites and applications was minimal and short-lived, and that DSC and eSign services regulated by the Controller of Certifying Authorities (CCA) are unaffected, further findings of the MeitY team, and any resulting action or tightening of compliance requirements by regulators, including the CCA, remain to be seen, the rating agency said.

 

While no misuse has been reported, it is not known whether the weak keys were exploited before disclosure. Any evidence of misuse, or any third-party claims, could raise contingent liability and reputational risks.

 

Meanwhile, the exit will need to be completed in coordination with the browser root programmes, including migrating affected customers to other certificate providers. Though the company has already taken steps for migrating affected customers, any execution slippages could cause further reputational damage, ICRA said.

 

Disclaimer: Views and outlook in this report belong to the brokerages and analysts cited. They do not reflect the views of Business Standard. Readers are advised to exercise discretion.