Certificate authority DigiCert has confirmed that an unauthorized account accessed archived customer information after an internal business system became externally reachable.
In its incident report filed with Mozilla’s CA compliance program, the company said the accessed records mostly contained customer representatives’ names, business email addresses, phone numbers and business addresses. A small minority also included customer-provided identity documents, such as passports, driver’s licenses or utility bills. DigiCert has not disclosed how many people or documents were affected.
The exposure began on February 4, 2025, when an infrastructure migration moved the archive system from a VPN-restricted network segment to an externally accessible availability zone. A self-registration feature intended for other uses of the account-management platform became available on the system. Accounts created through that flow were not subject to DigiCert’s usual multifactor authentication and, despite having no application assigned, could read archived records.
DigiCert noticed non-company accounts on the system on June 18, 2026, but initially concluded they could not access data. The company later confirmed that archived information was accessed between June 27 and July 2. An authorization fix deployed on July 2 blocked unassigned accounts from the archive; DigiCert confirmed the incident on October 19 after further investigation.
The account had read-only access and could not change records, approve identity validations or issue certificates. DigiCert said its certificate authority services, CertCentral and DigiCert ONE were unaffected, as were customer login credentials and issued certificates. The company has since disabled self-registration, moved remaining endpoints behind private networking, reset business-system passwords and added monitoring. DigiCert issues TLS certificates, but this incident involved its archived verification records rather than certificate operations.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
DigiCert Breach Exposes Customer Data and Some ID Documents
