DigiCert, one of the world's biggest certificate authorities, has started telling customers that an outsider was able to read part of its archive of customer records, including identity documents some people had handed over to get their certificates validated. The cause wasn't a sophisticated hack. It was a server move in early 2025 that quietly left an internal system open to the internet for well over a year.
What happened
According to DigiCert's incident report on Mozilla's Bugzilla tracker, the trouble started on February 4, 2025, when an internal business system was moved out of a network segment that could only be reached over VPN. After the move, the system could be reached from outside the company's network.
That system relied on an account manager that included a self-registration feature meant for other uses. Because the feature carried over, anyone who found the system could sign up for an account. Those accounts skipped the multi-factor authentication DigiCert normally requires and were set to read-only, and they weren't tied to any application. A separate authorization flaw, though, still let them browse archived customer data.
DigiCert says it noticed in June 2026 that the system was exposed and that an unassigned account had been created, and it deployed an authorization fix on July 2. At that point it treated the problem as an account-creation issue, not a data leak. Only after further investigation did the company confirm, on October 19, 2026, that an unauthorized account had read a subset of archived records between June 27 and July 2, 2026.
Who's affected
DigiCert describes the affected records as a "small proportion" of its archive, but it hasn't said how many customers or individuals are involved. Most of the exposed data was business contact information:
- Names
- Business email addresses
- Phone numbers
- Business addresses
For a small minority of accounts, the records also held a document the customer supplied to prove their identity, such as a driver's license, passport, or utility bill. DigiCert says it is still reviewing those documents to work out exactly who was affected and will notify those people once the review is done. Notification emails are already reaching some customers, and at least one recipient shared a copy publicly on X.
What wasn't affected
DigiCert stresses that its certificate operations were not touched. The account that got in could not write records, approve validations, or issue certificates, and the company says no certificates were issued, modified, or revoked as a result. Its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and customer login credentials and issued certificates remain valid and trusted. No action is needed on existing certificates.
Since the incident, DigiCert says it has restricted access to the affected system, turned off self-registration, and added extra access controls.
Why it matters
Certificate authorities collect identity paperwork precisely because they are trusted to vouch for who is behind a website or organization. That makes their archives attractive to criminals: a copy of a passport or driver's license plus a business email and phone number is exactly what's needed for convincing impersonation, account-recovery scams, and targeted phishing. The incident also shows how a routine infrastructure change, left unchecked, can undo a security boundary like a VPN without anyone noticing.
What you should do
- If you've bought or validated certificates with DigiCert, watch for a breach notice and read it carefully. Contact DigiCert through its official site rather than links in unexpected emails.
- Be wary of calls or emails that mention your certificate orders, DigiCert account, or validation details. Attackers may use the stolen contact data to make phishing look legitimate.
- If you submitted a passport, driver's license, or utility bill, consider credit monitoring or a credit freeze, and watch for attempts to use your identity.
- For your own organization, audit what changed after any network or cloud migration, and check that internal systems aren't reachable from the internet and don't allow open sign-ups.
0 Comments