Major certificate authority DigiCert has notified customers of a data breach involving an internal archiving system that was mistakenly exposed to the public internet during an infrastructure migration. The incident allowed unauthorized parties to obtain archived customer records, including personal identification documents submitted for certificate verification.

DigiCert confirmed that the breach did not affect its core certificate authority operations, certificate validation pipelines, or the CertCentral and DigiCert ONE platforms. The company disclosed details of the event in a post-mortem filed on Mozilla's Bugzilla platform, following disclosure requirements set by major root store programs including Mozilla, Google Chrome, Microsoft, and Apple.

How the exposure occurred

According to reports from BleepingComputer and The Record, the exposure originated in February 2025 during an infrastructure migration. An internal business system previously restricted to internal VPN access was moved to a network segment directly accessible from the internet.

DigiCert noted that the move was handled internally as an infrastructure adjustment rather than a formal security change, which bypassed the comprehensive review and sign-off processes usually required. Consequently, the exposed system operated without sufficient network filtering or baseline alerting for external requests.

The exposed host featured a self-registration mechanism intended for other applications that did not enforce multi-factor authentication. An external actor registered an unassigned account and leveraged an authorization flaw in the application to gain read-only access to archived records. As detailed by SecurityWeek, the unauthorized access took place between June 27 and July 2, 2026.

Delayed discovery of data access

DigiCert discovered the presence of unauthorized accounts in late June 2026 and received an external warning through its managed security research program. Administrators blocked the unauthorized account on July 2, 2026, and deployed fixes to restrict access to the host.

However, investigators initially classified the incident strictly as an unauthorized account creation flaw rather than a data exfiltration event. DigiCert assumed the unassigned accounts lacked permissions to query backend data stores and did not realize archived records had been retrieved.

On October 12, the company initiated a secondary review after suspecting that data access had occurred. By October 19, DigiCert confirmed that the rogue account had viewed customer records during the six-day window in mid-2026, prompting customer breach notifications.

Impact on customer records and identity files

The compromised system housed archived business records, including customer names, business email addresses, telephone numbers, and corporate physical addresses. For certain organizations and individuals, the archive also contained identity verification documents submitted during certificate issuance.

These verification files included government-issued identification documents such as driver's licenses and passports, as well as utility bills used to validate organizational identity. While DigiCert described the breach as affecting a limited portion of archived data, the company has not published the total number of affected entities.

DigiCert stressed that the intruder held read-only access. The unauthorized account lacked permissions to write records, approve validation requests, generate digital certificates, or view customer login credentials.

DigiCert response and remediation

Following confirmation of the unauthorized data access, DigiCert applied several remediation steps across the affected infrastructure. Engineers completely deactivated the self-registration feature on the internal account manager and re-established strict network segmentation to ensure the system is inaccessible from the public internet.

The company also audited user directories to identify and purge any remaining unassigned or non-DigiCert accounts, initiated mandatory password resets for all authorized business system users, and introduced enhanced logging and alerting for endpoint request volumes. Security teams are currently reviewing individual identity documents to complete specific customer notifications.

What you should do

Organizations and certificate administrators should evaluate their exposure and review authentication hygiene across certificate management accounts:

  • Review DigiCert notifications: Verify whether your organization received an official notification from DigiCert confirming exposure of contact details or verification documents.
  • Protect submitted identities: If your team submitted corporate officer passports, driver's licenses, or utility bills for Organization Validation (OV) or Extended Validation (EV) certificates, alert the affected individuals to monitor for identity theft or targeted spear-phishing.
  • Treat migration as security events: Ensure internal change management processes classify server and network migrations as formal security changes that require automated configuration audits and penetration testing before completion.
  • Audit network boundaries: Routinely scan external IP ranges for services that should reside behind VPNs or zero-trust network access (ZTNA) gateways, paying special attention to administrative portals and archiving systems.