ICRA kept eMudhra’s credit ratings unchanged on October 23 after a security lapse. While the firm exited its global certificate business, ICRA warned of potential reputational damage and regulatory scrutiny. Co-founder Kaushik Srinivasan said the lapse was a “one-off incident.” The company remains financially stable despite these ongoing business challenges.
ICRA has left its credit ratings on eMudhra Ltd untouched following a security lapse in the Bengaluru-based company's global website certificate business, though the agency cautioned that the episode could hurt the firm's reputation, invite regulatory scrutiny and weigh on client retention. The rating agency, in an update dated October 23, reaffirmed [ICRA]A (Stable)/[ICRA]A1 on eMudhra's Rs 35 crore of unallocated credit limits. The trouble stemmed from faulty key generation at eight intermediate certificate authorities, the entities that vouch for website certificates. Browser makers responded by blocking these authorities, and eMudhra revoked the certificates concerned. Its board has since decided to wind down the global certificate operation and concentrate on enterprise solutions and its other trust services. Read more: eMudhra to exit global website security certificate business after key-generation flaw Exiting the global SSL/TLS certificate segment should have only a modest direct effect on earnings, ICRA said, since the business brings in roughly 1% of consolidated revenue. The larger worry, according to the agency, is the knock-on effect. The lapse could make it harder for eMudhra to win and keep customers in its enterprise solutions arm and in overseas markets, which together make up 64% of revenue. ICRA also pointed to open questions around the regulatory probe and whether the weak keys were exploited earlier, either of which could trigger third-party claims and add to the reputational hit. On the positive side, ICRA noted that eMudhra carries no net debt and has healthy liquidity, giving it room to absorb exit costs and any short-term disruption. Also read: The internet had a rough 24 hours: PHP flaws, eMudhra scare, AI software breach and more eMudhra has maintained that no data was compromised and that its domestic Digital Signature Certificate and eSign operations are unaffected. Co-founder Kaushik Srinivasan, speaking to CNBC-TV18 on October 22, described the lapse as a one-off incident. ICRA said it will keep tracking the regulatory review along with eMudhra's business performance and order flow over the next few quarters.