The news of the eMudhra certificate hack has had an immediate impact in the stock markets.
Shares of eMudhra Limited, India’s largest licensed digital certificate issuer, crashed 20% to hit their lower circuit limit on Wednesday, October 21, falling from a previous close of ₹540 to ₹432 on the NSE, wiping out roughly ₹900 crore in market value in a single session. The stock opened sharply lower and stayed pinned near the bottom of its circuit band for most of the day, with trading volumes spiking as investors rushed for the exit.
The trigger: a global cybersecurity scare in which security researchers discovered that the private cryptographic keys behind eight of eMudhra’s digital certificates — the kind used to verify that websites are genuine — had been generated so weakly that they could be cracked almost instantly. The flaw forced Mozilla, Google, Apple and Microsoft to block the certificates within hours, and two of them went a step further and pulled trust in an entire eMudhra root certificate, an unusually severe response that rattled investors about the company’s credibility as a trust provider.
What actually went wrong
On October 17, a security researcher reported to the major browser makers that eight intermediate certificates issued by eMudhra had private keys so weak they could be reconstructed in a fraction of a second — essentially the cryptographic equivalent of a vault with its combination set almost entirely to zeroes. eMudhra traced the problem to a flawed script used during a key-generation ceremony in April 2025, which caused a weaker, unintended set of keys to be created and used by mistake.
Mozilla’s Firefox blocked the affected certificates within about three hours of being notified, and Apple, Microsoft and Google followed over the next few days. eMudhra revoked the certificates itself by October 18. By October 20, after multiple independent researchers had found and publicised the same flaw, Mozilla and Chrome escalated further and withdrew trust in an entire eMudhra root certificate — a rare move that effectively forces the company to migrate roughly 30,000 customer certificates to an unaffected alternative.
About eMudhra
eMudhra was founded in 2008 by Venkatraman Srinivasan, who continues to serve as the company’s Chairman and Managing Director and, along with Singapore-based investment vehicle Taarav Pte Ltd, remains its principal promoter. The company is headquartered in Bengaluru, with additional operations across the US, Europe, the Middle East and Southeast Asia.
eMudhra built its business around digital trust: it is India’s largest licensed Certifying Authority (CA), the entity that issues the digital signature certificates individuals and companies use to sign documents, file taxes, bid for government tenders and authenticate transactions online. At its IPO, the company held close to 38% of India’s digital signature certificate market. Its operations today span two broad verticals — Digital Trust Services, which includes digital signatures, SSL/TLS website certificates (issued under its emSign brand) and identity verification, and Enterprise Solutions, software for e-signing, paperless workflows and digital identity management sold to banks, governments and large enterprises worldwide.
IPO and stock market journey
eMudhra went public in 2022, with its IPO opening for subscription on May 20 and closing on May 24. The book-built offer was priced in a band of ₹243–256 per share and raised about ₹412.79 crore in total, combining a fresh issue of roughly ₹161 crore with an offer-for-sale by promoters Venkatraman Srinivasan and Taarav Pte Ltd. Shares debuted on the NSE and BSE on June 1, 2022, opening at ₹270 — a listing-day gain of around 5.5% over the issue price.
The stock (NSE: EMUDHRA) has been volatile since listing, swinging between roughly ₹364 and ₹826 over its 52-week range, as the market has alternated between enthusiasm for its digital identity and cybersecurity business and concerns about its rich valuation.
Market cap takes a hit
Before Wednesday’s fall, eMudhra’s market capitalisation stood at roughly ₹4,470 crore, with the stock having traded as high as ₹795 earlier in the year. At today’s lower-circuit price of ₹432, the company’s market value has dropped to approximately ₹3,580 crore — erasing a large chunk of the gains built up since listing, when the company’s market cap was closer to ₹2,000 crore at IPO. It’s a sharp reminder of how directly a cybersecurity firm’s stock price is tied to the one thing it’s supposed to guarantee: trust.
What happens now
eMudhra says it has stopped issuing new certificates from the affected root, is re-verifying every key-generation ceremony it has conducted, and is migrating affected customers to its other, unaffected root certificate. For investors, the coming quarters will likely hinge on whether global browser makers and enterprise customers treat this as a contained, process-level failure or a deeper reason to diversify away from eMudhra as a trust provider — and whether the company’s digital-signature and enterprise-solutions businesses, which make up the bulk of its revenue, can shield it from reputational fallout in its smaller but higher-visibility certificate-authority business.