Let’s start with a number.
Not 4 crore. Not 4 billion. Not some 100-digit code that would take a supercomputer centuries to crack.
That’s what one of the secret passkeys protecting a cybersecurity company’s certificates turned out to be. The kind of key that’s supposed to be practically impossible to guess.
And when the world found out, investors didn’t wait around to ask questions.
They hit the sell button. Hard.
The stock crashed 37% in just five trading days.
If you had put ₹1 lakh into this stock on 19th October, you’d have been left with about ₹63,000 just five trading days later.
Here’s how a single digit turned into a very expensive week for its investors.
But, what does eMudhra actually do?
Ever noticed the small lock icon that appears right before a website’s address in your browser?
That little lock is your browser’s way of saying: “Relax. This really is your bank, not a fake one built to steal your password.”
But how does your browser know that?
Through digital certificates. Think of them as an ID card for websites.
These ID cards are issued by Certificate Authorities (CAs), trusted organisations whose job is to check that a website really is who it claims to be. Once they’ve verified it, they issue a digitally signed certificate that links the website’s identity to its security key.
Browsers like Chrome, Safari and Firefox are built to trust these CAs. So when a CA vouches for a website, your browser believes it.
eMudhra is one of those companies. It’s best known in India for digital signatures, the ones used for income tax filings, company registrations, tenders and banking. It also ran a global business issuing these website “ID cards.”
Its entire business runs on one word.
So what went wrong?
Imagine hiring the best security agency in town to guard your building, and discovering their master key was a paperclip.
That’s roughly what happened.
It was a quiet Saturday. Markets were shut, traders were offline, and most investors were probably enjoying a lazy weekend.
Until someone stumbled onto a very strange discovery.
On October 17, 2026, an independent security researcher found that eight of eMudhra’s global intermediate Certificate Authorities were cryptographically weak. In simple terms, the keys weren’t strong enough to keep their secrets safe.
The keys had been created back in April 2025.
Which means the weakness sat there, unnoticed, for about 18 months. And according to the company, it had passed two rounds of audits in that time.
What exactly went wrong? Google’s security team said the keys were generated without enough randomness, the ingredient that makes a secret key impossible to guess. eMudhra’s co-founder said the keys were mistakenly shortened by software. Either way, the result was the same: keys that could be worked out from public information.
Why is that such a big deal?
Because in the wrong hands, those keys could have been used to make a fake website look real to your browser.
A fake banking site. With the padlock. Looking perfectly real.
To actually pull off an attack, a hacker would still have needed a way to get between you and the real site. So this wasn’t a “click and you’re hacked” situation. And there’s no public evidence anyone actually misused the keys.
But for a company whose entire job is proving websites are genuine, even the possibility is a nightmare.
Two of the eight keys were for code signing, which is used to prove software comes from a genuine publisher. So the worry stretched beyond websites to apps and software too.
Then came the domino week
Here’s how fast it all unravelled:
Oct 17: The weak keys are disclosed. Google and Mozilla move to block them.
Oct 18: eMudhra revokes all eight certificates, which the company says it did within 14 hours of discovery.
Oct 19-20: Apple follows on October 19, and Microsoft on October 20.
Oct 21: CERT-In, India’s cybersecurity agency, issues an advisory. The shares fall 20%, hitting the maximum allowed drop in a day on both exchanges.
Oct 22: eMudhra announces shutting down its global website certificate business altogether.
Google. Apple. Microsoft. Mozilla.
When all four of the world’s biggest gatekeepers of the internet stop trusting you in the same week, the market notices.
“It’s only 1% of our business”
That’s eMudhra’s main defence.
The global certificate business that had the problem brings in only about 1% of the company’s revenue. The company says no data was breached and its systems weren’t hacked.
Its Indian digital signature and eSign services, the bread and butter of the business, run on completely separate systems. CERT-In confirmed those services were not affected.
There’s more on the positive side. ICRA retained eMudhra’s ratings at [ICRA]A (Stable) after the incident. And the company has said it will help affected customers switch to replacement certificates free of cost.
So, if only 1% of the business broke, why did the stock lose over a third of its value?
The real reason investors panicked
Because the market wasn’t pricing the 1%.
It was pricing the trust behind the other 99%.
eMudhra doesn’t just issue certificates. It also sells the technology other organisations use to run their own security systems, including certifying authority solutions, identity and access management, and certificate lifecycle management.
Now imagine you’re a bank, a government department or a large company that buys security software from eMudhra.
You’ve trusted them to protect your most sensitive systems.
Would you sign the next contract without a second thought? Or would you start calling their competitors?
That’s the real risk. Not the lost revenue. The lost confidence.
What happens next?
The company has made its move: exit the problem business, protect the core, and move on.
Whether the market believes that story will depend on a few things over the coming weeks:
The tech giants. Browser makers are reviewing the wider certificate setup, not just the eight keys. Any further action would keep the story alive.
The investigation. The Ministry of Electronics and IT has set up a team to look into the incident. Its findings could either calm nerves or raise new questions.
The customers. The biggest test is whether enterprise and government clients stay put. Any contract losses would show whether the damage really is limited to 1%.
The next results. eMudhra reports its Q2 FY27 numbers on November 4. It’ll be the first time management faces analysts since the incident. Expect plenty of questions, and the answers will matter.
The Bottom Line
For most companies, a mistake in a 1% business is a footnote.
For a company that sells trust, it can become the headline.
eMudhra has acted quickly and drawn a clear line around the problem. Now it has to prove that line holds.
Because in cybersecurity, trust takes years to build.
And sometimes, just one number to break.
Disclaimer: This newsletter is for informational and educational purposes only and is not investment advice or a recommendation to buy, sell or hold any security. Investments in securities are subject to market risks. Please read all related documents carefully and consult a qualified adviser before investing.
Click Here For The Original Source.
——————————————————–
