Why eMudhra Share Price Fell 20% After Security Breach

The short version

• eMudhra shares fell 20% to Rs 432 after a cybersecurity incident involving eight intermediate certificates.
• Mozilla revoked the affected certificates and began changes to its trusted certificate list.
• The stock's record high was Rs 1,024 in December 2024, leaving it nearly 60% below that level.

eMudhra shares fell by the maximum 20% on Wednesday, October 21, after a security incident involving private keys linked to eight intermediate digital certificates came to light. The stock touched Rs 432, marking its biggest single day fall since listing.

The incident concerns certificates issued within eMudhra's public trust infrastructure. Mozilla said the private keys associated with eight intermediate certificates had been compromised on October 17. The development has raised concerns about the security of the affected certificates and prompted steps to prevent them from being trusted by browsers and other applications.

eMudhra said it had started an investigation and taken steps to contain the affected certificates. The company also clarified that the incident was limited to the specified intermediate certificates and did not affect its root certificate authority private keys or other intermediate certificate authorities.

What happened to eMudhra's certificates?

The incident involves eight intermediate certificate authority certificates linked to a key generation ceremony conducted in April 2025. Such certificates form part of the digital trust infrastructure used to verify the authenticity of digital certificates. Private keys are used in cryptographic operations, so a compromise can create risks for the trust placed in certificates associated with those keys.

Mozilla said the private keys linked to the eight eMudhra intermediate certificates were compromised on October 17. In response, it blocked the affected certificates in Firefox through OneCRL, its central list of revoked certificates. Revocation prevents Firefox from continuing to trust certificates that have been identified as affected.

Mozilla also began updating its trusted certificate list to remove the root certificate that signed the affected intermediate certificates. This step matters for applications that rely on Mozilla's trust store but do not receive OneCRL updates. The two actions address different parts of the trust system, with the aim of preventing affected certificates from continuing to be accepted by software.

What eMudhra said about the incident

eMudhra said it had activated its incident response procedures after learning about the security issue. The company began containing the affected certificates and started working with browser operators and root store operators to protect users and preserve the integrity of the wider web public key infrastructure, commonly known as WebPKI.

In its statement, eMudhra said it was investigating how the incident occurred. It is also reviewing its security controls and operational procedures to identify any changes that may be needed. The company has not provided a final account of the incident in the information available here.

The distinction between the affected intermediate certificates and the company's other certificates is important. eMudhra said the incident was restricted to the specific intermediate certificates created during the April 2025 key generation ceremony. Its root certificate authority private keys and other intermediate certificate authorities were not affected, according to the company's statement.

A root certificate authority sits at the top of a certificate trust chain. Intermediate certificate authorities operate below it and can issue certificates under the authority delegated to them. A compromise involving intermediate private keys can therefore require targeted action even when the root private keys remain secure.

Why Mozilla is removing trust from affected certificates

Digital certificates help browsers and other software verify the identity of websites and establish trusted connections. Certificate authorities issue certificates under defined trust arrangements, and browsers maintain lists of authorities and certificates they accept.

When private keys associated with an intermediate certificate are compromised, the affected certificates may no longer be safe to trust. Revoking them is one way to prevent continued acceptance. Mozilla's action through OneCRL addresses Firefox, while the planned changes to its trusted certificate list target applications that use the Mozilla trust store without receiving OneCRL updates.

For eMudhra, the immediate issue is the containment of the affected certificates and the outcome of the investigation. The company's statement does not establish that every certificate or service connected to its business has been compromised. It specifically says its root CA private keys and other intermediate CAs were not affected.

The incident also illustrates why trust store operators and certificate authorities need to coordinate when a security problem arises. Browser operators decide which certificates their software trusts, while certificate authorities investigate incidents involving certificates they issue and take steps to contain any risk.

eMudhra share price: important figures

The share price reaction was sharp, with the stock hitting its 20% fall limit during Wednesday's session. The decline was the largest single day fall since eMudhra's listing, according to the supplied market information.

Particulars	Details
Company	eMudhra Ltd.
Share price during the session	Rs 432
Fall during the session	20%
Date of reported incident involving compromised keys	October 17
Number of affected intermediate certificates	8
Key generation ceremony	April 2025
Record high	Rs 1,024
Record high reached	December 2024
Fall from record high	Nearly 60%

The stock had already moved substantially below its record high of Rs 1,024, reached in December 2024. At Rs 432, it was nearly 60% below that peak. The latest fall adds to that gap, although the available information does not provide enough detail to separate the effect of this incident from other factors behind the stock's earlier movement.

Sharp falls following company specific developments can also change how market participants assess uncertainty around a business. In this case, the security investigation, the response from browser operators and the company's future disclosures are all relevant to understanding how the situation develops.

Other stock declines covered by WeloMoney include the MTAR Technologies share price fall and the Oracle shares decline from their peak. These are separate events involving different companies and should not be treated as evidence of a common cause.

What investors should watch

The next important development is the outcome of eMudhra's investigation. The company has said that it will provide further updates as the investigation progresses and additional findings are confirmed. Those findings may clarify the circumstances behind the compromise and whether changes to its security controls or operating procedures are required.

Investors tracking eMudhra can watch for the following developments:

• The company's explanation of how the private keys were compromised.
• Any further steps involving the affected intermediate certificates.
• Updates from browser and root store operators on certificate trust.
• Details of changes to security controls and operating procedures.
• The stock's price movement as the company releases confirmed information.

The company has also clarified a separate matter involving the removal of its C1 and C3 root CAs from Mozilla's trust store. eMudhra described that removal as a voluntary, planned activity unrelated to the security incident. This distinction matters because the planned root CA removal should not be treated as part of the compromise without further evidence.

The investigation remains in progress. The available company statement does not provide a final explanation of how the keys were compromised or a complete timeline for the investigation. Further confirmed disclosures from eMudhra and updates from the relevant trust store operators will help establish the full scope of the incident.

About eMudhra

eMudhra Ltd. provides document processing automation, artificial intelligence and data security platforms. Its public trust infrastructure includes certificate authorities used within digital certificate systems. The incident described by the company concerns a specific set of intermediate certificates, rather than all of its certificate authorities.

Frequently asked questions

Why did eMudhra shares fall 20%?

eMudhra shares fell 20% to Rs 432 after a cybersecurity incident involving private keys linked to eight intermediate certificates. Mozilla said the keys had been compromised on October 17 and took steps to block the affected certificates in Firefox.

How many eMudhra certificates were affected?

The incident involved eight intermediate certificates created as part of a key generation ceremony in April 2025. eMudhra said the incident was limited to those certificates and did not affect its root CA private keys or other intermediate CAs.

What action did Mozilla take against eMudhra's certificates?

Mozilla blocked the affected certificates in Firefox through OneCRL, its central list of revoked certificates. It also began updating its trusted certificate list to remove the root certificate that signed the affected intermediates, covering applications that do not receive OneCRL updates.

Did eMudhra's root CA private keys get compromised?

eMudhra said its root CA private keys were not affected by the incident. The company identified the problem as limited to the specific intermediate certificates associated with the April 2025 key generation ceremony.

What was eMudhra's share price after the fall?

eMudhra shares traded at Rs 432 after falling 20% on Wednesday, October 21. The decline was the stock's biggest single day fall since listing, and the price was nearly 60% below its record high of Rs 1,024 reached in December 2024.

What happens next in the eMudhra cybersecurity investigation?

eMudhra said it was investigating the incident and reviewing its security controls and operational procedures. The company said it would provide further updates as the investigation progresses and additional findings are confirmed.