Shares of Bengaluru-based eMudhra Ltd plunged 20% on Wednesday after a security researcher identified a potential vulnerability involving eight intermediate certificate authorities used in the company's global digital security business.
The stock fell to ₹432 on the National Stock Exchange (NSE), reflecting investor concerns about the incident's possible impact.
The researcher alleged that the affected certificates contained weak cryptographic keys that could potentially be reconstructed using artificial intelligence-assisted techniques.
The findings were reported to major browser root programmes operated by Apple, Google and Mozilla.
eMudhra Denies Data Breach
Responding to the concerns, eMudhra said its infrastructure had not been compromised and no customer data had been breached.
The company maintained that its physical and digital security controls remained operational.
It clarified that the vulnerability was confined to its global Transport Layer Security (TLS) operations, which function independently of its Indian Digital Signature Certificate (DSC) and eSign businesses.
According to eMudhra, its domestic digital signature and electronic signing services continue operating normally.
The global TLS segment contributes approximately 1% of the company's revenue.
However, eMudhra acknowledged that the incident could create reputational risks whose financial impact cannot currently be determined.
The company is contacting potentially affected customers to arrange replacement certificates and protect essential services.
It is also coordinating with browser root programme operators while investigating the underlying technical failure.
Weak Keys Traced To April 2025 Generation Process
The issue involves eight intermediate certificate authorities established under eMudhra's elliptic curve cryptography (ECC) root.
These were created during a key generation ceremony on April 30, 2025, using hardware security modules certified to Federal Information Processing Standards (FIPS) 140-2 Level 3.
According to the company, an error during a cryptographic wrapping and unwrapping procedure generated a second set of weaker keys alongside the original secure keys.
The weaker keys were subsequently published to browser root stores.
eMudhra said the affected infrastructure had undergone independent audits for two consecutive years and had been included in browser trust lists since mid-2025.
The company continues investigating the incident while implementing corrective measures.
