Shares plunge to ₹318 as global browser restrictions, the company's exit from the SSL/TLS certificate business and regulatory scrutiny raise concerns over reputation, customer retention and future growth.

Shares of eMudhra Limited remained under heavy selling pressure on Monday, October 26, 2026, extending their sharp decline following a cybersecurity incident involving the company's global Transport Layer Security (TLS) certificate business. The stock fell as much as 10% intraday to a fresh 52-week low of ₹318.35 on the BSE, reflecting growing investor concerns about the potential financial and reputational consequences of the incident.

The stock has declined approximately 43% over the past five trading sessions and has fallen around 53% from its September high of ₹677.50 recorded on September 16, 2026. The steep correction has erased a substantial portion of the company's market value as investors reassess the risks facing its digital trust and cybersecurity-related operations.

At around 11:04 AM on Monday, eMudhra shares were trading approximately 9% lower at ₹322.75, while the BSE Sensex was marginally higher. Trading activity also increased, with approximately 2.08 million shares changing hands across the NSE and BSE, around 1.5 times the average trading volume reported in the source.

The sell-off followed the company's disclosure of a security incident affecting certain intermediate certificate authorities in its global TLS certificate business, the subsequent restrictions imposed by major internet browser providers and its decision to withdraw voluntarily from the global SSL/TLS certificate business.

What Triggered the Sharp Fall in eMudhra Shares?

The immediate trigger for the stock's decline was the cybersecurity incident disclosed by eMudhra to the stock exchanges on October 21, 2026.

According to the company's disclosure, the incident involved eight intermediate Certificate Authorities (CAs) created during a key-generation ceremony conducted on April 30, 2025. Certificate authorities play a critical role in establishing trust between websites, servers and users by issuing digital certificates that help authenticate online identities and secure communications.

The company said a flaw in the key-generation process resulted in a weaker secondary set of cryptographic keys being created alongside the intended keys. The weaker keys were subsequently published to browser root stores, raising concerns about the reliability of the affected certificate infrastructure.

The incident became more serious after an independent researcher reported the issue to major browser root programmes on October 17, 2026.

Digital certificates are a foundational component of internet security. If the cryptographic keys supporting a certificate authority are compromised or considered insufficiently secure, browser providers may restrict or distrust the affected certificates to protect users and websites.

For companies operating in the digital trust industry, the consequences can extend beyond the immediate technical problem. Customers depend on certificate providers to maintain reliable security standards, and any failure can affect confidence in their services.

Major Browser Providers Block Affected Certificates

Following the disclosure, major browser providers took action against the affected certificate infrastructure.

Google Chrome and Mozilla Firefox blocked the affected intermediate certificates within hours of the issue being reported, while Apple and Microsoft subsequently implemented restrictions. eMudhra also revoked the affected certificates.

The Indian Computer Emergency Response Team (CERT-In) issued an advisory concerning the incident. Google separately announced that it would remove the emSign ECC Root CA – G3 from the Chrome Root Store with effect from October 27, 2026, according to the reported developments.

These actions are significant because browser root programmes determine which certificate authorities are trusted by widely used internet browsers. Restrictions can disrupt the normal operation of affected certificates and require customers to transition to alternative providers.

The practical consequences may include certificate replacement, migration work, additional compliance checks and disruption to customer relationships. The scale of the impact will depend on how many customers and services are affected, how quickly migrations are completed and whether the incident leads to further restrictions.

The incident has also drawn attention to the operational controls and security procedures required of companies that provide digital certificates and other trust services.

eMudhra Decides to Exit Global SSL/TLS Certificate Business

On October 22, 2026, eMudhra informed the stock exchanges that its board had decided to voluntarily withdraw from the global SSL/TLS certificate business.

The company said it would focus on its core enterprise solutions and other trust services. The decision represents a strategic shift following the security incident and the restrictions imposed by browser providers.

The exit will require coordination with browser root programmes and the migration of affected customers to other certificate providers. According to the reported rating assessment, eMudhra had already initiated steps to migrate affected customers.

However, completing the transition could involve operational challenges. Customers may need assistance with certificate replacement, implementation and continuity arrangements, while the company must manage the process without creating further disruption.

The withdrawal could also affect the company's revenue mix, customer relationships and future growth opportunities in the global certificate market. The extent of the financial impact will depend on the contribution of the affected business to overall revenue and the company's ability to compensate for any lost business through its remaining operations.

The decision to exit may reduce some of the direct operational exposure associated with the affected certificate business, but it does not automatically eliminate the wider reputational or regulatory consequences of the incident.

MeitY Forms Special Team to Investigate Security Incident

The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the leak of private keys associated with web security certificates issued by the company.

The investigation is an important development because the incident involves infrastructure that supports digital authentication and secure internet communications.

Regulatory authorities may examine the circumstances surrounding the key-generation process, the effectiveness of security controls, the company's response and the potential implications for customers and other stakeholders.

The findings could influence whether additional safeguards, compliance requirements or corrective measures are introduced. However, the scope and outcome of the investigation remain uncertain.

Government officials reportedly indicated that the impact on Indian websites and applications was minimal and short-lived. The company's digital signature certificate and eSign services regulated by the Controller of Certifying Authorities (CCA) were also reported to be unaffected.

Nevertheless, the final assessment will depend on the investigation's findings and any subsequent regulatory action.

For investors, the distinction between the affected global certificate business and the company's other operations is important. A limited technical impact on domestic services would not necessarily prevent reputational concerns from affecting customer acquisition or retention elsewhere.

ICRA Flags Reputational Risks and Customer Retention Concerns

Credit rating agency ICRA retained its ratings on eMudhra's ₹35 crore unallocated credit limits at [ICRA]A (Stable)/[ICRA]A1 in an update dated October 23, 2026. However, the agency highlighted potential reputational damage, regulatory uncertainty and risks to customer retention.

The retained ratings indicate that ICRA had not changed the specified credit ratings at the time of its update. They should not be interpreted as confirmation that the cybersecurity incident will have no effect on the company's business or financial performance.

ICRA said it would continue to monitor developments, including the regulatory review, business momentum and order inflows in subsequent quarters.

The agency also noted that cybersecurity threats were an identified risk for eMudhra's trust services business. Because customers rely on the company's ability to maintain secure and dependable digital infrastructure, reputational damage could have consequences beyond the affected certificates.

A company can address a technical vulnerability and still face commercial challenges if prospective or existing customers become reluctant to rely on its services.

Overseas Revenue Exposure Adds to Investor Concerns

The potential impact on eMudhra's overseas business is another key factor being assessed by investors.

According to ICRA's reported assessment, overseas markets account for approximately 64% of the company's revenue. Management indicated that around 35%–40% of the global business would not be affected by reputational spillover, but the broader consequences remain uncertain.

The main question is whether concerns arising from the certificate incident could affect customer acquisition and retention in other enterprise businesses, particularly among banking, financial services and insurance (BFSI) customers and government clients.

Large institutional customers typically place significant importance on cybersecurity controls, regulatory compliance and operational reliability. Any reassessment of a service provider's risk profile could influence procurement decisions, contract renewals or the time required to secure new business.

The incident could also increase scrutiny during customer due diligence and vendor assessments, even where services are not directly connected to the affected certificate infrastructure.

However, it would be premature to conclude that the entire overseas business will be affected. The actual impact will depend on customer responses, the findings of the investigation and the company's ability to demonstrate effective corrective action.

Could the Incident Affect Future Growth and Profitability?

The financial consequences for eMudhra will depend on several factors beyond the immediate stock-price decline.

First, the company may lose revenue associated with the global SSL/TLS certificate business as it implements its exit. The financial effect will depend on the size and profitability of that business and how quickly resources can be redirected towards other activities.

Second, the migration of affected customers could involve additional operational costs. The company may need to devote personnel and technical resources to customer support, certificate replacement and transition arrangements.

Third, reputational concerns could influence future order inflows. If customers delay or reconsider contracts, growth in enterprise solutions and other trust services could come under pressure.

Finally, the regulatory investigation could result in further compliance requirements or corrective measures. The extent of any additional cost or liability remains unknown.

ICRA has indicated that it will monitor business momentum and order inflows over the coming quarters. These indicators will be important in determining whether the company can limit the consequences of the incident and sustain demand for its remaining services.

At this stage, the available information does not establish the full financial impact, and investors should avoid treating either the worst-case scenario or a rapid recovery as certain.

No Confirmed Misuse Reported, but Uncertainty Remains

One important distinction is that the reported information did not establish confirmed misuse of the weaker cryptographic keys.

However, ICRA noted that it was not known whether the keys had been exploited before the issue was disclosed. Evidence of misuse or third-party claims could introduce additional contingent-liability and reputational risks.

The absence of confirmed misuse is relevant, but it does not remove the underlying concern about the security incident. Browser restrictions and certificate revocations can create operational consequences even when there is no publicly confirmed exploitation.

The investigation and subsequent technical assessments will be important in clarifying the nature of the incident, its potential exposure and the adequacy of the company's response.

Investors should distinguish between confirmed developments, such as the announced business exit and browser restrictions, and risks that remain uncertain, including potential claims or the scale of any customer losses.

What Investors Should Monitor Next

The coming weeks and quarters could be important for assessing the longer-term consequences of the incident. Investors may focus on the following developments:

• Regulatory investigation: Findings from the MeitY-led team and any subsequent action by relevant authorities.

• Certificate migration: The pace at which affected customers are transferred to alternative providers and whether the process is completed without significant disruption.

• Customer retention: Evidence of changes in contract renewals, new customer acquisition and order inflows.

• Core business performance: Revenue and growth trends in enterprise solutions and other trust services.

• Financial impact: Any disclosures concerning exceptional costs, contingent liabilities or changes in business guidance.

• Market confidence: Whether the stock stabilises as additional information becomes available or remains under pressure amid continued uncertainty.

The market's response will likely depend on whether subsequent disclosures reduce uncertainty or reveal a broader impact on the company's operations.

Market Outlook

eMudhra's sharp share-price decline reflects investor concern over the cybersecurity incident, the restrictions imposed by major browser providers and the company's decision to exit its global SSL/TLS certificate business. The stock's fall of approximately 43% in five trading sessions and around 53% from its September high highlights the scale of the reassessment taking place in the market.

The company continues to have enterprise solutions and other trust services, and the reported impact on domestic websites and applications was described as limited. However, the potential consequences for overseas customers, future order inflows and reputation remain important uncertainties.

From an investor's perspective, the immediate focus should be on the regulatory investigation, the completion of customer migration, evidence of customer retention and the financial performance of the company's remaining businesses. The outcome of these developments will be more informative than the stock's recent decline alone.

The key issue is whether eMudhra can contain the consequences of the security incident and rebuild customer confidence while maintaining growth in its core businesses. Until greater clarity emerges, the stock may remain sensitive to regulatory updates and company disclosures.