loading
loading
ICRA retains eMudhra ratings, but flags regulatory and reputational risks after security breach - Published OnOct 24, 2026 | 11:22 IST - Last Updated OnOct 24, 2026 | 11:29 IST ICRA expects the direct financial impact to be limited, as the global TLS certificate business contributes about 1% of eMudhra's consolidated revenue. However, the impact on customer trust and the outcome of the regulatory review remain key uncertainties. Credit rating agency ICRA has retained its ratings for Bengaluru-based eMudhra Ltd after a security incident in its global website certificate business, but flagged potential reputational damage, regulatory uncertainty and risks to customer retention. In an update dated October 23, ICRA retained its ratings at [ICRA]A (Stable)/[ICRA]A1 on the company's ₹35 crore unallocated credit limits. The incident involved a flaw in the generation of security keys for eight intermediate authorities that verify website certificates. The issue led to browser makers blocking the affected authorities and eMudhra revoking the certificates. The company's board subsequently decided to exit the global certificate business and focus on its core enterprise solutions and other trust services. The agency said the direct financial impact of eMudhra's decision to exit the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business was likely to be limited, as it contributes about 1% of consolidated revenue. However, ICRA cautioned that the impact could extend beyond the revenue from the business being discontinued. It said the incident could affect customer acquisition and retention in eMudhra's enterprise solutions business and overseas markets, which account for 64% of its revenue. The agency also flagged uncertainty over the regulatory investigation and the possibility of past misuse of the weak keys, which could lead to third-party claims and further reputational damage. ICRA said the company's net debt-free position and strong liquidity provide a cushion against the costs of exiting the business and any near-term disruption. The company has stated that no data was breached and its Indian Digital Signature Certificate and eSign businesses remain unaffected. In an interview with CNBC-TV18 on October 22, Kaushik Srinivasan, Co-founder of eMudhra, called the cybersecurity lapse as a “one-off incident on a bad day”. ICRA said it would continue to monitor the outcome of the regulatory review, eMudhra's business momentum and order inflows in the coming quarters.
document fetched 2026-10-25 02:56 · canonical https://cnbctv18.com/market/icra-retains-emudhra-ratings-but-flags-regulatory-and-reputational-risks-after-security-breach-20018496.htm