Every day in The CCO Dispatch, I look at the communications decisions companies make and the stories they tell. This report steps back to look at what those stories add up to across Q3 and what they tell us about how to counsel executives in Q4.

Across five narrative lanes, I assess which corporate explanations held up, which stopped working and why, drawing on cases from the US, Europe, Asia and the Middle East. Each lane includes my counsel on what to question, check or prepare before your next announcement, plus a look at what could bring these stories back in Q4.

If you’ve ever heard “it doesn’t matter because it affects such a small part of our business” in a crisis meeting, this one’s for you.

eMudhra is an Indian company that issues the digital certificates websites use to prove they’re real. When your browser connects to a site, it checks for one of these certificates and asks, did a company I trust issue this? Google, Apple, Microsoft and Mozilla all had eMudhra on that trusted list. If it’s doing its job, you’d never hear its name.

But on Thursday, October 22, eMudhra announced it was exiting that business after a serious security failure, and in both of its public statements last week it pointed out that the impacted business was only about one percent of its revenue.

Ok?

The company also said “the level of social media amplification around this incident has brought scrutiny that is out of proportion” and so, “in view of this,” the board had concluded that leaving was the right decision for eMudhra and its shareholders.

It’s a strange thing for a company that sells trust to say about a trust failure, and an even stranger thing to list it as the reason for a board decision. In my experience, highlighting the attention itself is a pretty reliable way to get even more attention of it. Most people had never heard of eMudhra before last week. But this introduced the name to a lot of people who would otherwise have missed the story entirely, and by Friday it had drawn a public rebuke from Google

This is not a small failure.

Last week, a security researcher discovered that eight of eMudhra’s signing keys, the secret numbers it uses to stamp a certificate as legit, were so weak that anyone could work them out from public information in under a second. A key like this is supposed to be a random number roughly 116 digits long. One of eMudhra’s was just the number 4. Six of the eight keys could stamp website certificates, so anyone who worked them out could forge a certificate for any site on the internet and make a fake look real. Chrome and Firefox blocked the keys within a few hours, and Apple and Microsoft followed over the next few days.

Now, this wasn’t a data breach. eMudhra says none of the eight keys was ever used to issue a certificate to a customer, the infrastructure wasn’t compromised and no data was taken. It revoked the keys on October 18 and started working with browser makers and customers. All the right operational decisions.

But that response also isn’t sufficient to contain the full extent of the damage. Because anyone could forge a certificate with those keys, browsers can now no longer tell eMudhra’s real certificates from fakes so they’re pulling trust from the whole batch, including every legitimate certificate that was issued. Mozilla did that on October 20, and Chrome will do the same on Tuesday, October 27. According to Chrome, that’s roughly 30,800 live certificates, and nearly all of them belong to American universities through InCommon, a shared certificate service for higher education that moved onto eMudhra’s platform earlier this year. Cornell alone has more than 300.

So, one percent of an Indian company’s revenue is also 30,000 certificates at US universities that have to be replaced before Tuesday morning, on a product that was supposed to be the thing nobody had to think about.

The underlying failure was serious too.

The weak keys were created in April 2025 and went unrecognized for 18 months, through two rounds of independent audits and through at least one alarm. By eMudhra’s own account in the Mozilla bug thread, a routine security file failed a check in 2025 because it had been signed with a key that didn’t match the certificates. The fix was to re-sign it with the key that did match, which turned out to be the weak one. The error went away but the question of why there were two keys in the first place was never asked. Of course, Chrome is asking it now, along with whether eMudhra’s other certificates should stay trusted at all. India’s IT ministry has opened its own investigation and the shares lost about a third of their value.

Now, the commercial explanation for leaving makes sense. eMudhra cited rising compliance costs, data-sovereignty rules and competitors giving certificates away for free. At one percent of revenue, a board could reasonably conclude the returns no longer justify the cost of running this business to the standard browsers now demand. The company is also doing the right things for customers by offering free replacement certificates, keeping its systems running until the old certificates expire, and a commitment to publish a full report on what went wrong.

So the operations were handled. What went wrong was what the company said, and it kept going wrong for five days.

On Wednesday, October 21, eMudhra said the business was only about one percent of revenue “however, this may have some reputational risks on eMudhra which cannot be quantified.” That’s the right posture because this is a small business facing unknowable consequences. But then on Thursday, the same one percent figure came back with the opposite conclusion because now, they said, the scrutiny was out of proportion.

In fairness, Thursday’s statement was a stock-exchange filing addressed to shareholders, and shareholders need to know how much money is at stake. They got the number and they reacted fine. The stock rose the day after the exit was announced and the company’s credit rating held. If the only people reading were investors, there’d be no story here.

But a statement written for shareholders never stays only with shareholders. The “out of proportion” line was quickly pulled into the coverage and is already in the company’s Wikipedia entry. And the one audience that reads every word a certificate authority publishes is the browser team at Google, which is still deciding whether eMudhra’s other certificates stay trusted long enough to get its customers through the exit.

Which brings us to Friday.

In the Mozilla thread where browser makers and the company work through the incident, Google had asked for a report on what happened. eMudhra’s representative replied that “intense social media scrutiny and analysis by investors/customers” had made “doing any meaningful analysis of the event pretty much impossible.” Same complaint as Thursday, now given to the audience that is going to make these decisions.

Google answered the same day. “Social media scrutiny” and “analysis by investors/customers,” it wrote, “are not acceptable explanations for delayed responses here.” The scrutiny was “the predictable result of eMudhra’s own failure,” and offering it as an excuse “conveys that reputation management is being prioritized over the obligations that eMudhra still owes to the billions of relying parties its mistake exposed.” Mozilla added that eMudhra had missed its deadline to answer questions, asked for another day, and missed that too.

So the people deciding eMudhra’s future had just told it, in public, that it was doing comms instead of its job.

eMudhra’s reply came over the weekend, and it didn’t back down. “We do not accept its characterisation of our conduct,” the company wrote. It argued that it’s one link in a chain of trust and that the auditors, the partner who cross-signed the keys and the browser makers themselves all had 18 months to notice and also didn’t. It argued that Google was assigning motive before the report was in and it argued that anyone still exposed has software that doesn’t check for revoked certificates, which isn’t eMudhra’s problem. Some of that is fair in a post-mortem; someone in the thread has since asked Google why its own key-checking tool missed this. None of it is what you say to the people deciding your fate while their questions sit unanswered. Within an hour, another member of the thread posted that 107,000 certificates had been forged with the weak keys since the disclosure, 106,000 of them for google.com, as proof it could be done.

To be fair, some of the online reaction was definitely overblown. One widely shared claim put 60 million certificates at risk; the real number was about 30,000, and India’s own IT ministry backed that up. But that correction is the regulator’s to make; the company that created the problem doesn’t get to grade the reaction.

What makes this sting is that Google had already told eMudhra what good communication would look like. Three days before the “social media” comment, its team noted in the same thread that eMudhra’s public statements never specified the actual certificates affected, never gave dates for when browsers would stop trusting them, and never told customers how to check whether they were hit or what to do about it. That’s the first page of any customer notice but the company’s judges had to ask for it.

So what does a comms leader do in a situation like this?

The instinct in the room will be to argue about the attention instead of the core issue. But don’t go there. The only thing that shrinks the attention is by answering the questions people are asking. That means:

The board has decided what eMudhra will stop doing operationally but whether customers stick around for the rest comes down to whether anyone trusts it to keep doing everything else.