eMudhra Shares Dip Amid Security Concerns
Shares of eMudhra Ltd. experienced a 4% decline in Friday's trading session, following the company's announcement that it has appointed KPMG to undertake an independent review of a recent cybersecurity incident. This development comes days after the discovery of weak security keys within its global Transport Layer Security (TLS) business, which had already led to a sharp drop in the company's stock.
The stock touched a low of Rs 338.60, representing a 4.23% fall from its previous close of Rs 353.55. It opened at Rs 353.55 and reached a high of Rs 353.55 during the session.
KPMG Appointed for Independent Review
In a regulatory filing today, eMudhra confirmed KPMG's appointment. This decision aligns with the company's earlier commitment, disclosed on October 21, to engage an independent external reviewer to examine the security lapse thoroughly.
Details of the Cybersecurity Incident
The incident in question involved eight intermediate certificate authorities (CAs) associated with eMudhra's global TLS operations. An independent researcher identified that the security keys were weak and potentially susceptible to reverse-engineering, possibly through AI-assisted techniques. Such vulnerabilities raise significant concerns, as they could enable attackers to generate fraudulent digital certificates for websites, compromising online security.
eMudhra's Clarification and Impact Assessment
eMudhra has clarified that its Indian Digital Signature Certificate (DSC) and eSign businesses remain unaffected by this incident. These critical operations run on infrastructure entirely separate from its global TLS business and continue to function normally. The company described the affected global TLS segment as a minor part of its overall operations, accounting for approximately 1% of its revenue. However, it acknowledged the potential for reputational risks.
The weakness was traced back to a flaw during a Key Generation Ceremony held on April 30, 2025. This flaw, occurring during a wrap/unwrap step, resulted in the generation of a second set of weak keys alongside the intended strong keys. These weak keys were subsequently published to browser root stores. eMudhra stated it is actively working with potentially affected customers to provide replacement certificates and prevent disruptions to critical services.