eMudhra to quit overseas web certificate business after key breach

eMudhra Ltd. will exit the overseas market for web security certificates after an extraordinary security breach exposed the private keys of intermediate certificates. The breach, disclosed on Tuesday, lets attackers issue eight certificates that appear legitimate to devices lacking recent updates. The firm’s stock hit the circuit breaker for two sessions and shed more than a third of its market value within 48 hours. Certificates for non‑Indian subscribers made up less than 1 % of revenue but caused a disproportionate hit to reputation. eMudhra will keep issuing SSL certificates for Indian websites, a spokesperson told The Hindu.

Reaction

Co‑founder Kaushik Srinivasan said perception threats have arisen, called the event a one‑off script error, and promised stricter operational security controls. He said the company has not received significant negative feedback and is humbled by customer support. An independent firm not involved in past audits will review eMudhra’s security practices. Srinivasan also noted that forged certificates are unlikely to affect smart devices because those rely on private‑trust certificates, not public ones.

Next Steps

The IT Ministry has formed a committee to probe the incident, and eMudhra has responded to its queries and will stay engaged. The firm will tighten security measures and focus on its Indian SSL business.

Context

The breach shows how a tiny share of a company’s sales can cause major brand damage, prompting regulator action and tighter security efforts.