DigiCert, a certificate authority whose digital certificates browsers rely on to confirm websites are genuine, says a migration mistake left an internal business system reachable from the internet and let an unauthorized account read archived customer records, including identity documents for some customers, BleepingComputer reported Thursday. The incident shows how one unreviewed network change at a trust provider can expose the documents customers hand over to prove who they are.
What Happened
In its incident report on Mozilla's Bugzilla tracker, where browser root programs follow certificate authority incidents, DigiCert said a Feb. 4, 2025, infrastructure migration moved the system out of a network segment reachable only through a virtual private network. A self-registration feature meant for other uses then let outsiders create accounts that skipped the multifactor authentication DigiCert otherwise requires. Those accounts were read-only, but an authorization gap let them see archived data.
DigiCert spotted non-DigiCert accounts June 18, 2026, and concluded they had no data access. A security research program reported June 21 that outsiders could create accounts; DigiCert confirmed it June 24 and shipped an authorization fix July 2. The company now says an unauthorized account read data from June 27 until that fix. It first suspected archived data had been accessed Oct. 12 and deemed the event reportable Oct. 19. DigiCert acknowledged the matter "was initially handled as an account-creation issue rather than a data-access event," according to BleepingComputer.
Most exposed records held business contact details such as names, business email addresses, phone numbers and addresses. For a small minority of customers, they included documents the customers had provided, such as a driver's license, passport or utility bill. DigiCert has not published a count of affected people; it offers summary statistics to root program representatives on request. BleepingComputer reported that DigiCert has begun sending notices and is still reviewing identity documents to determine who was affected.
DigiCert says the access was read-only, no certificates were issued, modified or revoked, and its certificate systems run on separate network segments that were not accessed.
Why It Matters
Organizations that sent DigiCert identity documents for employees during certificate validation should ask whether those records were in the exposed archive, and staff should be warned about phishing that poses as DigiCert notices. For boards, DigiCert's own root-cause analysis is the vendor-risk lesson: the migration was treated as infrastructure work rather than security work, and monitoring was not reassessed afterward.
What to Watch
Commenters on the Bugzilla thread have asked DigiCert for figures on the affected data and whether subscriber verification information was exposed. DigiCert has reset passwords, disabled self-registration, added alerts and moved remaining endpoints behind private load balancers. Two audit items remained open with a Nov. 6 due date, including confirming that no business system server is reachable from the internet. The Primary Wire reported in October that browsers moved to distrust another certificate authority, eMudhra, over weak keys.
