DigiCert has disclosed a data breach in which an internal business system was inadvertently exposed to the internet during a server migration, allowing unauthorized access to archived customer information and identity documents. The certificate authority said the incident affected a small subset of its archived customer data. Exposed records included names, business email addresses, phone numbers and business addresses.
For some individuals, the accessed data also included personal identification documents such as driver's licenses, passports and utility bills. DigiCert has started notifying affected customers. Cloud architect Fabian Bader shared a copy of his notification on X, remarking that the leak described as limited had in fact covered his full personal data and potentially any verification documents he submitted for his certificate.
According to the notification, DigiCert is still reviewing identification documents to determine who was affected and will contact those individuals once that review concludes. The company described the information involved as names, business email addresses, phone numbers and business addresses shared with DigiCert, plus, where provided, an identification document such as a driver's license, passport, utility bill or other document bearing a name and address.
An incident report on Mozilla's Bugzilla platform states that a February 2025 server migration mistakenly exposed an internal business system that had previously been reachable only through a VPN. The system hosted a self-registration feature intended for other applications, which let external users create accounts. While those accounts were not assigned to any application, an authorization flaw allowed them to read archived customer information in read-only mode.
DigiCert first found unauthorized accounts on the exposed system in June 2026, but initially concluded they could not reach customer information because no application was assigned to them. A report later came in through the company's managed security research program warning that external users could create accounts on the system. DigiCert applied fixes to restrict access and address the authorization flaw, but at that point did not know archived data had been accessed.
A further investigation on October 19 confirmed that an unauthorized account had accessed customer information between June 27 and July 2, 2026. DigiCert acknowledged in its report that the matter was initially handled as an account-creation issue rather than a data-access event. The company said the account had read-only access and could not modify records, approve certificate validations or issue certificates. Access to the system has been restricted, self-registration disabled and additional access controls added. DigiCert said its certificate authority services, CertCentral and DigiCert ONE platforms were not compromised, and that customer login credentials and issued certificates remain secure.
More cybersecurity news from TechManNews.
