ICRA keeps eMudhra ratings after security breach, flags reputational risks

what happened

India's ICRA has kept its credit ratings on eMudhra Ltd, a Bengaluru company, despite a security failure in its global website certificate unit, according to TradingView, which cites an update dated October 23. The agency affirmed the [ICRA]A (Stable) and [ICRA]A1 ratings on the firm's ₹35 crore of unallocated credit lines, while warning about possible damage to its reputation.

The breach stemmed from a bug in creating security keys for eight intermediate bodies that validate website certificates. Browser developers blocked those bodies, and eMudhra cancelled the certificates it had issued. Its board then chose to leave the global certificate business and concentrate on enterprise software and its other trust services.

ICRA estimates the direct revenue loss from leaving is small, since the unit brings in roughly 1% of consolidated sales. The agency cautioned, however, that the fallout could reach further, affecting customer acquisition and retention in enterprise and overseas markets that generate 64% of revenue. It also pointed to the open regulatory review and the chance that the weak keys were misused earlier, which could invite third-party claims. The company says no data was exposed and its Indian Digital Signature Certificate and eSign operations are unaffected. Co-founder Kaushik Srinivasan told CNBC-TV18 the lapse was a "one-off incident on a bad day."

why it matters

For markets this is a company-level story with limited spillover, as the rating outlook stays stable. The agency's view rests on the firm's net debt-free balance sheet and strong liquidity, which it sees as a buffer against exit costs. Key items to watch are the outcome of the regulatory review and order inflows in coming quarters.

tags

instruments