37% Two-Day Plunge as MeitY Probes Flawed Security Keys and Big Tech
Shares of digital identity and cybersecurity solutions provider eMudhra plunged into an unprecedented freefall on Thursday, October 22, 2026, crashing by another 18% during morning trade to hit an intraday low of ₹357 on the National Stock Exchange (NSE). The relentless sell-off follows a catastrophic 20% lower-circuit lock on Wednesday, October 21, when the stock tumbled from ₹540 to ₹432, taking cumulative two-day market losses to a staggering 37%. The acute panic selling was ignited by severe disclosures regarding the cryptographic vulnerability of private keys tied to eight intermediate certificates in the company’s global Transport Layer Security (TLS) and website certificate division. With institutional and retail investors questioning operational governance and client retention, the issue quickly escalated into a national security matter after India's Computer Emergency Response Team (CERT-In) issued an alert, the Ministry of Electronics and Information Technology (MeitY) constituted a high-level inquiry team, and global web browser conglomerates moved swiftly to distrust the compromised certificates.
The April 2025 Key Generation Flaw: CERT-In Alert and Global Browser Blacklist
The genesis of the crisis traces back to eMudhra’s internal Key Generation Ceremony conducted in April 2025, during which cryptographic private keys were generated for eight intermediate certificates meant to anchor its global website encryption architecture. Subsequent independent technical audits revealed that several of these private keys were mathematically weak and susceptible to extraction from publicly accessible data, creating a dangerous vulnerability where malicious actors could theoretically forge digital certificates in the name of legitimate domains to orchestrate credential harvesting, user spoofing, or malware distribution. Acting swiftly on the breach, CERT-In issued an official advisory cautioning domestic infrastructure operators against website impersonation and trojanized payloads posing as trusted software. Simultaneously, the world’s leading operating system and browser gatekeepers—including Google, Apple, Microsoft, and Mozilla—initiated coordinated blacklisting actions to block and revoke trust in the impacted certificates, ensuring global web traffic is shielded from potentially fraudulent credentials issued under those specific roots.
eMudhra Defends Domestic DSC Integrity as MeitY Scrutinizes Systemic Trust Deficit
Attempting to stem market panic, eMudhra issued an official clarification emphasizing that no unauthorized end-user certificates were ever issued to live websites from the eight compromised intermediate certificates, that its core data center infrastructure was not breached, and that its primary revenue-generating domestic operations—including Digital Signature Certificates (DSC) and eSign workflows across Indian enterprise and banking networks—remain fully isolated and secure. Despite corporate reassurances, the newly assembled MeitY special task force is actively conducting a root-cause forensic audit to ascertain how substandard entropy compromised the key generation ritual and to verify whether the lapse extended beyond the global TLS unit into domestic software pipelines. For capital market participants, the existential overhang lies in the reputational damage to an enterprise whose entire business model relies on cryptographic trust and regulatory certification. As global trust stores reassess eMudhra’s Certificate Authority (CA) status, Dalal Street analysts warn that potential foreign client churn, stringent audit overheads, and heightened regulatory scrutiny could dampen future revenue visibility, keeping the stock vulnerable to volatile swings as the government investigation proceeds.
