DigiCert data breach: archived customer IDs read via exposed system, what to do

DigiCert, one of the largest certificate authorities, has disclosed that an internal business system holding archived customer-representative records was reachable from the internet for about 17 months after a February 2025 server migration, and that an unauthorized account read some of that data between 27 June and 2 July 2026. The company says its certificate issuance systems were not touched. For anyone who has bought certificates from DigiCert, the practical risk is not forged certificates but targeted phishing and, for a small minority, exposed identity documents.

Key points

• DigiCert's own incident report (Mozilla Bugzilla bug 2084460) says a migration on 4 February 2025 made an internal system externally reachable, including its account registration endpoint.
• An unauthorized account accessed archived customer information between 27 June and 2 July 2026; an authorization patch released on 2 July ended that access.
• Most affected records hold business contact details; a small minority also contain a customer-provided document such as a driver's licence, passport or utility bill.
• DigiCert says the account was read-only, that no certificates were issued, modified or revoked, and that its CA, CertCentral and DigiCert ONE were not affected.
• DigiCert has not published how many people or accounts are affected; it is still reviewing identity documents and says it will notify those affected.

What to do

• Who is affected: people and organisations whose representatives went through DigiCert's identity or organisation validation, if their records were archived on this system. DigiCert says it will notify affected people; breach notices began going out in early November, according to BleepingComputer.
• Treat unexpected email or calls that mention DigiCert, your certificates or your validation as suspect, since names, business email addresses, phone numbers and addresses may be exposed. Check that any notice really comes from DigiCert before clicking a link, for example by going to DigiCert's site yourself.
• If you submitted ID documents to DigiCert, watch for signs of identity misuse and consider the credit-monitoring steps that apply where you live.
• You do not need to reissue or revoke certificates because of this incident. DigiCert says certificates and customer login credentials remain secure. If your own risk policy says otherwise, that is your call, but the report gives no sign of key exposure.
• Check your own estate: the root cause is a network change that exposed a self-service endpoint. Confirm that no internal business system's origin server is reachable from the internet, and that sign-up pages on internal tools are disabled.

What happened

According to DigiCert's report, the system archives information about customer representatives used for identity validation. On 4 February 2025 a migration moved it off a VPN-restricted network segment, which left its account registration endpoint reachable from outside. Accounts created through that endpoint skipped multi-factor authentication and were given read-only access to archived data, and the system did not check that an account was assigned to an application.

DigiCert says it first noticed non-DigiCert accounts on 18 June 2026 but wrongly concluded they had no access to data, and placed the system behind a web application firewall. On 21 June a managed security research program reported that external account creation might be possible; DigiCert confirmed it on 24 June. The unauthorized access to archived data took place from 27 June to 2 July, when an authorization patch ended it. DigiCert first suspected data access on 12 October, determined on 19 October that the event was reportable and filed a preliminary report on 20 October. BleepingComputer quotes DigiCert as saying the incident was "initially handled as an account-creation issue rather than a data-access event."

Self-registration was disabled and external endpoints moved to internal load balancers on 24 October, and a least-privilege review was completed on 30 October.

Background

Certificate authorities validate who is asking for a certificate, and for organisation-validated and extended-validation certificates that means collecting business details and, in some cases, personal documents from representatives. Those records are valuable to attackers because they make convincing phishing lures. They are also the reason CAs report incidents to browser root programs such as Mozilla's, which require a public incident report with a timeline and root cause. DigiCert's report follows that format.

How it works

The report lists three contributing factors. First, a network change was made without a security review. Second, monitoring was not reassessed after the migration, so account creation through the external endpoint raised no alert. Third, an authorization gap: accounts registered through the endpoint got default read access and skipped MFA. Any one of these alone would probably have limited the damage; together they let an outsider register and read.

DigiCert's remediation, per the report, includes blocking new external account creation at the WAF, limiting hostnames to VPN traffic except approved endpoints, resetting passwords for all users of the business system, returning an error for unauthorized accounts, requiring security sign-off for network access changes, a completed penetration test, new file access and request-volume alerts, and a named owner for the system's security posture. Two items were still open when we read the report: an internal audit confirming that no business system origin server is externally accessible, and a final review of alerting for unexpected account creation and permission changes, both due 6 November 2026.

What it means

For DigiCert customers the immediate task is vigilance rather than remediation. The data is mostly contact details, and scammers who know that you buy certificates from a given vendor can write a believable renewal or validation email. For the small group with ID documents on file, the exposure is more serious and lasting.

For the wider industry the case is a reminder of how exposure happens: not an exploit, but a migration that quietly changed who could reach a login page. The delay is also notable. The access ended on 2 July but DigiCert determined a reportable event only in October, about three and a half months later, because the early review wrongly judged the accounts harmless.

What we don't know yet

• How many people or accounts are affected. Neither the incident report nor press coverage gives a number; the report says only "a small proportion" of archived data. DigiCert offers summary statistics to root program representatives on request.
• What prompted the October investigation. A commenter on the bug asked; the report does not directly answer.
• Whether the data has been used. We found no report of misuse.
• Dates that differ between pages. The report lists the non-compliance start as 4 February 2025, though data access began on 27 June 2026, and one comment calls an action item complete that the table lists as ongoing.

What to watch next

Watch for DigiCert's closing of the two open action items on 6 November, for Mozilla root program follow-up questions on the bug, for a figure on affected people when notifications finish, and for any regulator filings that follow from the identity documents involved.

Sources

• DigiCert incident report, Mozilla Bugzilla bug 2084460
• BleepingComputer: DigiCert data breach exposes customer information, identity documents
• SC World: DigiCert reports data breach following server migration error
• Cybersecurity News: DigiCert confirms data breach