DigiCert, one of the world's largest certificate authorities, has confirmed that someone outside the company got into an internal business system holding archived customer information. The data mostly covered business contact details. For what DigiCert calls "a small minority" of customer accounts, it also included passports, driver's licences, utility bills and other documents showing a name and address. The company reported the incident to the browser root programmes through Mozilla's Bugzilla tracker, according to Cyberpress and CyberSIXT. DigiCert has not said how many people, organisations or documents were affected. It describes the accessed part of the archive only as "small." Customer notices started arriving this week. Troy Hunt, who runs Have I Been Pwned, posted the email he received, and Bitcoin developer Jameson Lopp said he had been notified too. DigiCert says its certificate authority operations, CertCentral, DigiCert ONE, customer login credentials and issued certificates were not affected.
What Happened
All the press accounts trace the incident to an infrastructure migration on February 4, 2025. That migration moved the archive system out of a network segment that could only be reached over a VPN and into an availability zone that could be reached from the internet. DigiCert treated the move as an infrastructure change rather than a security change, so nobody reviewed what it newly exposed, according to CyberSIXT's summary of the company's report. The system also had insufficient alerting.
The timeline DigiCert gives, as reported by GBHackers, Cyberpress and CyberSIXT:
- February 4, 2025: The migration makes the archive system and its self-service registration endpoint reachable from the internet.
- June 18, 2026: DigiCert's internal team notices accounts that do not belong to employees. It wrongly concludes that accounts with no application assigned cannot reach data. A web application firewall is put in front of the system to block new registrations through the external path.
- June 21, 2026: A managed security research programme reports the external account creation issue, which prompts more engineering work.
- June 27 to July 2, 2026: Unauthorised access to archived data takes place, as later established by investigators.
- July 2, 2026: An authorisation patch goes into production. Accounts without an application assignment now get HTTP 401 responses.
- July 9, 2026: System hostnames are restricted to VPN traffic, apart from approved external endpoints (per Cyberpress).
- October 19, 2026: Cybersecuritynews reports that DigiCert confirmed unauthorised data access on this date and filed its preliminary incident report the next day. Cyber Web Spider describes October 19 as the disclosure date. The two accounts differ slightly on what happened that day.
The gap between the patch and confirmation is the most notable part of the response. Several outlets report that DigiCert first treated the problem as an account-creation issue rather than a data-access issue. As a result, more than three months passed between closing the hole and confirming that data had been read.
What Was Taken
Every account describes the exposed data the same way:
- Names
- Business email addresses
- Telephone numbers
- Business addresses
- For a small minority of accounts: passports, driver's licences, utility bills or other documents showing names and addresses
These identity documents appear to be the paperwork customers submitted during certificate validation to prove who they are. CyberSIXT reports that DigiCert says one account created through the exposed registration flow accessed a small proportion of the archive.
Volume: DigiCert has given no figure, and no outlet has reported one. According to the notification Troy Hunt shared, the company is still reviewing the identity documents to work out who is affected and will notify those people once the review is finished. No regulator filing has been published.
DigiCert says it found no certificate issuance, validation changes or revocation activity linked to the unauthorised account. Customers do not need to replace active certificates.
Why It Matters
Certificate authorities hold some of the most reliable identity data on the internet. Organisation Validation and Extended Validation certificates require customers to hand over verified business details and, sometimes, personal identity documents. If that material leaks, it is well suited to impersonation: someone could use a real company's verified contacts and an employee's passport scan to social-engineer registrars, banks, or the CA's own support desk.
The incident is also a reminder that "internal" and "archived" do not mean low risk. The system sat quietly exposed for about 16 months, and a read-only account with no application assigned was still enough to read records.
This is also not DigiCert's only security problem this year. SourceSecurity.com and SecurityInformed.com, in articles dated October 8, reported a separate incident. In that case an attacker posing as a customer in DigiCert's Salesforce-based support chat sent a ZIP file containing a .scr payload. According to those reports, the attacker compromised a support analyst's workstation on the fifth attempt and moved through internal tools from April 4 to April 14. The attacker then abused a "view-as-customer" troubleshooting feature to get initialisation codes and activate 60 EV Code Signing certificates that could be used to sign malware. Nothing reported so far links that intrusion to the archive exposure, and DigiCert has not connected the two. Taken together, though, they show that internal business tooling at a CA is now a real attack surface.
The Attack Technique
This was not an exploit chain. Two configuration failures combined:
- Exposure through migration. The archive ran its own account manager instances, separate from the customer-facing products. The February 2025 move made them reachable from the internet. The account manager platform shipped with a self-service registration feature built for other deployments, and that feature had been left enabled on this one.
- Authorisation that failed open. Staff logged in with multi-factor authentication, but self-registered accounts skipped it. Those accounts got default read-only permissions and no application assignment. DigiCert's own team assumed that combination meant no data access. It did not. Cyberpress describes this as a separate authorisation failure, distinct from the registration problem.
The WAF rule added on June 18 stopped new sign-ups. It did nothing about accounts that already existed, and the unauthorised reads happened after that rule went in.
DigiCert has not named who was behind the account. No group has claimed responsibility and no leak has been reported.
What Organizations Should Do
- Treat network migrations as security changes. Any move that changes how reachable a system is (VPN-only to internet, private to public subnet) should trigger a security review and an external attack-surface scan before cutover.
- Turn off unused features in identity platforms. Audit every instance of your identity provider or account manager for self-service registration, social login and default role grants that the deployment does not need.
- Make authorisation deny by default. An account with no application, group or role assigned should get nothing, not "read-only." Test this directly, because DigiCert's team assumed it and was wrong.
- Apply MFA to every account type. Enforce MFA at the identity layer for all principals, not only staff, so that an account created through an unexpected path cannot skip it.
- Treat unknown accounts as a data-access incident until proven otherwise. When strange accounts appear, pull access logs for those accounts right away rather than reasoning about what they should be able to do. Blocking sign-ups is not the same as removing access.
- If you are a DigiCert customer: Expect well-targeted phishing that uses your real contact and validation details. Warn the staff named on your certificate orders. Ask DigiCert directly whether your identity documents were in the accessed set, and add extra verification to any certificate or account change requests that arrive by email or chat.
Sources: DigiCert Confirms Data Breach After Security ... | DigiCert Confirms Data Breach Exposing Customer Details and Sensiti... | DigiCert Confirms Data Breach Exposing Customer Personal Informatio... | DigiCert Data Breach Details DigiCert News | Blog elhacker.NET: DigiCert confirma filtración de datos de cliente... | DigiCert data breach exposed some customers' ID documents | DigiCert Cyberattack: Major Blow to Certificate Security Security... | DigiCert Security Breach Exposes 60 Certificates Security News