eMudhra Shares Decline; KPMG Appointed To Review Cybersecurity Incident Involving Weak TLS Key Flaw

eMudhra Ltd shares came under pressure on Friday after the company appointed KPMG to conduct an independent review of a cybersecurity incident involving its global digital certificate operations. The appointment follows the company's 21 October disclosure concerning weaknesses identified in certain digital certificates.

The company informed the stock exchanges on 30 October that KPMG would examine the reported incident. The decision fulfils its earlier commitment to appoint an independent external reviewer to assess the matter.

The concerns involve eight intermediate Certificate Authorities (CAs) linked to eMudhra's global TLS business. An independent researcher found a potential weakness. Certain security keys might be reverse-engineered with the help of artificial intelligence. That discovery has raised fears of fraudulent website certificates.

eMudhra Share Price: Stock Declines Over 4%

eMudhra shares were trading at ₹341.05 on 30 October 2026, at 1:14 PM IST, down 3.51% from the previous close of ₹353.45. The stock opened at ₹353.50 and touched an intraday high of ₹355.00 before declining to ₹337.55.

The latest decline adds to the stock's recent weakness. The stock has shed 42.79% in the past month alone. Its decline since January 2026 stands at 39.05%. Over the past year, the damage has reached 47.64%.

The stock had touched a 52-week high of ₹681.60 on 22 September 2026, before hitting a 52-week low of ₹314 on 27 October 2026.

The Factors Behind The eMudhra Cybersecurity Incident

According to the company's 21 October statement, the issue originated during a Key Generation Ceremony (KGC) conducted on 30 April 2025, under its Elliptic Curve Cryptography (ECC) root.

A flaw in the wrap/unwrap process generated a second set of weak keys alongside the original strong keys. The weaker keys were subsequently published to browser root stores.

The researcher reported the vulnerability to major browser root programmes operated by Apple, Google, Microsoft and Mozilla. eMudhra said it was continuing to investigate the root cause.

India DSC And eSign Businesses Remain Unaffected

eMudhra clarified that the incident has no connection with its Indian DSC and eSign operations, which run on entirely separate infrastructure.

The company also stated that:

• Its infrastructure was not compromised.

• No data breach occurred.

• Physical and logical security controls remained intact.

• Indian DSC and eSign services continued operating normally.

Revenue Exposure Remains Contained, But Reputation Is Another Matter

The affected global TLS operations represent approximately 1% of eMudhra's revenue. A relatively small share. Yet the company has cautioned that the reputational consequences may be harder to measure.

Customer outreach is already underway. eMudhra is offering replacement certificates to potentially affected customers, seeking to keep essential services running without interruption. KPMG's independent review adds another layer of scrutiny to the investigation.

Also Read - Varun Beverages Q3 CY26 Results: Net Profit Reaches ₹831 Crore, While Board Sets 5 November As Dividend Record Date