DigiCert breach exposed archived business-customer data, not certs

Certificate authority DigiCert disclosed a breach of an internal business system that exposed archived customer records. The company published a post-mortem on Mozilla's Bugzilla. The headline for operators: this is a contact-data and identity-document leak, not a compromise of certificate issuance or validation.

What happened

An internal business system was moved out of a VPN-restricted network segment in February 2025 and, unintentionally, became reachable from the internet. An unauthorized account was created in it and used to read archived customer data. Coverage from SecurityWeek attributes the access to a self-registration feature that required no multi-factor authentication; Recorded Future describes it as an unassigned account created in the exposed system. Both agree the account was read-only.

DigiCert says it "determined that the business system was externally accessible when that was not intended" on June 21, 2026. The unauthorized access ran from about June 27 to July 2, when the issue was fixed. On October 19, DigiCert confirmed the access and classified it a reportable event.

What was exposed

• Customer names, business email addresses, phone numbers and business addresses.
• In some cases, customer-provided documents containing a name and address — driver's licenses, passports and utility bills.

DigiCert has not said how many customers are affected.

What was not exposed

DigiCert is explicit on scope: "The access could not write records, act as a validation approver, or issue certificates," and "the CA systems operate on their own secure network segments and were not affected by this external access." Customer login credentials were not taken. A spokesperson said that "to our knowledge, there is no evidence of misuse of the information involved."

No attacker or group has been named.

Action checklist

1. If you're a DigiCert business customer, treat the exposed fields — name, business email, phone, address — as known to an attacker and raise your bar for vendor-impersonation phishing.
2. Verify any "DigiCert" payment-detail or account-change request out of band; leaked contact data is BEC fuel.
3. If you uploaded identity documents (passport, license, utility bill) during validation, monitor for identity-fraud use of those specific documents.
4. No certificate rotation is required on the basis of this incident — issuance and validation were not touched.

Context

The failure mode here is mundane and common: a system migration treated as an infrastructure change rather than a security change, with no review of its new exposure and no alerting on account creation. DigiCert notes the incident was reportable under the root-store rules of Mozilla, Google Chrome, Microsoft and Apple — the reason a CA's internal mishaps surface publicly on Bugzilla at all. The good news for the web PKI is the part that held: the segmentation that kept issuance off the exposed network did its job.