DigiCert, one of the world’s largest certificate authorities, has confirmed that an internal business system was reachable from the internet for about 17 months, and that someone read archived customer data from it. The exposed records include business contact details and, for a small minority of accounts, scans of passports and driver’s licenses. DigiCert says certificate issuance and customer logins were not affected.
What happened
According to DigiCert’s incident report filed with Mozilla’s CA compliance process, the system was moved on February 4, 2025 from a VPN-restricted network segment to a different availability zone. That move left it reachable from the internet, and no security review caught the change.
The system runs on an account manager platform with a self-registration feature meant for other uses. Accounts created through it were not covered by multi-factor authentication and got read-only access by default, yet they could still reach archived customer information.
DigiCert says staff noticed non-DigiCert accounts on June 18, 2026 and concluded they could not access data, then put the system behind a web application firewall that blocked new registrations. A report from its managed security program arrived on June 21. A fix to authorization went live on July 2. The company says the data access window ran from June 27 to July 2. It first suspected access to archived data on October 12 and confirmed it on October 19, then filed a preliminary report the next day.
Who is affected
DigiCert says most of the exposed data was business contact information: names, business email addresses, phone numbers and business addresses. A small minority of customer accounts also held a customer-provided document such as a driver’s license, passport or utility bill showing a name and address. Cyber Security News reports that a DigiCert email to customers says the company is reviewing identity documents to identify affected individuals and will notify them when that review is done.
DigiCert describes the affected data as a subset and a small proportion of its archive, but its public report gives no count of people, organizations or documents. It says the account could not write records, approve validations or issue certificates, and that its log review found no issuance, validation or revocation activity tied to the account. The company says active certificates do not need to be replaced.
What to do
This section is our analysis, not DigiCert guidance, apart from the point about certificates.
- Do not replace certificates because of this incident; DigiCert says no certificate action is needed.
- If you gave DigiCert a passport, license or utility bill for validation, watch for a notification and treat unexpected emails or calls that quote your details with suspicion. Confirm any DigiCert message through your account portal rather than links in the email.
- Expect targeted phishing aimed at certificate administrators, since names, roles and business contact details were exposed.
- Check that your own internal tools do not rely on network location alone for access control. DigiCert’s report lists that as a lesson: authorization must not be delegated to network position.
What we still do not know
DigiCert has not disclosed how many customers or documents were exposed, and a commenter on the Mozilla report has asked for those numbers without a public reply at the time we checked. It is not confirmed whether the data was copied or misused beyond access in the logs, or who created the accounts. Two final action items, an internal audit and an alerting review, were still listed as ongoing.
Sources: DigiCert incident report, Mozilla Bugzilla bug 2084460 (full report posted around November 3, 2026); Cyber Security News, “DigiCert Confirms Data Breach” (November 5, 2026).
Leave a Reply