Certificate authority DigiCert has disclosed unauthorized access to an internal business system that archived information customer representatives had provided for identity validation, according to DigiCert’s public incident report in Mozilla’s Bugzilla CA Certificate Compliance tracker.
Most affected records were limited to names, business email addresses, phone numbers, and business addresses. For a smaller set of customer accounts, the exposure included identity documents such as driver’s licenses, passports, utility bills, or other documents containing a name and address.
DigiCert has not publicly disclosed the number of customers or individuals affected. In the Bugzilla report, the company said supporting data with personal information was not attached and that summary statistics could be made available to root program representatives on request.
BleepingComputer and The Register also reported that DigiCert has begun notifying affected customers. Both outlets said DigiCert was still reviewing identification documents to determine the specific people involved.
How a migration created the exposure
DigiCert traced the root cause to a February 4, 2025 infrastructure migration. The internal business system was moved from a VPN-restricted network segment to a different availability zone that was externally accessible. That change also made an account-registration endpoint reachable from outside the intended network.
The system used an account manager that DigiCert also uses for other implementations. A self-registration feature meant for other use cases became available on the internal business system. Those self-registered accounts were not subject to the multi-factor authentication normally required for staff users, and unassigned accounts had read-only access to archived data.
The timeline in DigiCert’s report
- February 4, 2025: The internal business system was moved to an externally accessible availability zone.
- June 18, 2026: DigiCert observed non-DigiCert accounts on the business system and initially concluded that unassigned accounts did not have data access.
- June 21, 2026: DigiCert received a report through its managed security program about possible account creation through external access.
- June 27 to July 2, 2026: A later investigation determined that unauthorized access to archived data occurred during this window.
- July 2, 2026: DigiCert released an authorization patch that ended the confirmed data-access window and blocked unassigned accounts from accessing archived data.
- October 12, 2026: DigiCert began investigating whether archived data had been accessed.
- October 19, 2026: DigiCert confirmed unauthorized access to a subset of archived data and determined that the incident was reportable under browser root program requirements.
Certificates do not appear to need emergency replacement
DigiCert said certificate authority services, CertCentral, DigiCert ONE, customer login credentials, and DigiCert-issued certificates were not affected.
DigiCert said the unauthorized access could not write records, act as a validation approver, or issue certificates. It also said a log review found no validation, issuance, or revocation activity tied to the account.
That means certificate administrators should not treat this disclosure the same way as a compromised private key or misissued certificate incident. DigiCert’s public position is that no action is needed for active certificates or continued use of its services.
The remaining risk is identity and targeting
For affected organizations, the practical risk sits with the archived records. Business contact details tied to certificate validation may make phishing, renewal scams, or impersonation attempts more believable. If ID documents were included, the response may also involve privacy, HR, legal, or identity-protection teams rather than only IT operations.
The public report does not state that the exposed data has been misused. The point is narrower: the information involved can be useful to an attacker even when certificates remain trusted.
What organizations should check
Organizations that use DigiCert can take a measured approach while waiting for direct notification or account-specific details. The current public record supports checking four areas.
- Which current or former staff handled DigiCert validation and may have submitted names, business contact details, passports, driver’s licenses, utility bills, or similar documents.
- Whether notices from DigiCert arrived in administrator, procurement, security, legal, or certificate-owner mailboxes.
- Whether help desk, IT, security, and finance teams know to verify unexpected DigiCert-themed requests through established internal channels.
- Whether certificate inventories and DigiCert account contacts are current, so any future certificate-related notices reach the right team.
What DigiCert says it changed
DigiCert listed several remediation steps in the incident report, including blocking the account-registration endpoint, adding authorization checks that return HTTP 401 for accounts with no assigned application, restricting business-system hostnames to VPN traffic, requiring security sign-off for network accessibility changes to internal tools, completing a penetration test, adding file-access and request-volume alerts, resetting passwords, disabling self-registration on business system instances, moving remaining endpoints to private-IP load balancers, assigning a named security owner, and completing a least-privilege review.
The broader lesson for operators is that moving an internal system is a security change when it alters network reachability, authentication paths, logging, or authorization assumptions.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
