Thought Leadership
Following a server migration, an internal system became accessible from the internet. An unauthorized individual accessed customer data, including passports and driver’s licenses in some cases.
Certificate authority DigiCert has reported a data breach. The incident stemmed from a server migration in February 2025, during which an internal business system was inadvertently exposed to the internet. Previously, the system had only been accessible via VPN. An unauthorized individual used this access to retrieve a small portion of archived customer data.
The exposed information included names, business email addresses, phone numbers, and business addresses. For some customers, the records also contained identity documents submitted during certificate validation, such as driver’s licenses, passports, and utility bills. DigiCert has not disclosed how many individuals were affected.
Self-Registration Feature and Access Control Flaw
According to an incident report published on Mozilla’s Bugzilla platform, the exposed system included a self-registration feature originally intended for other applications. This allowed external users to create accounts. Although these accounts were not associated with any application, a flaw in the access control mechanism allowed them to access archived customer data in read-only mode.
DigiCert first detected unauthorized accounts in June 2026. Initially, the company assumed these accounts had no access to customer data. Following a report through its security researcher program, DigiCert restricted access and fixed the vulnerability. However, it failed to detect that data had already been retrieved.
It was not until October 19 that a subsequent investigation confirmed that an unauthorized account had accessed customer data between June 27 and July 2, 2026.
“The incident was initially handled as an account-creation issue rather than a data-access event.”
DigiCert
Certificates Remain Unaffected
According to DigiCert, the unauthorized account had read-only access. It could not modify records, approve certificate validations, or issue certificates. The certificate authority’s services, as well as its CertCentral and DigiCert ONE platforms, were not affected. Customer credentials and previously issued certificates remain secure, the company said.
DigiCert has disabled self-registration and introduced additional access controls.
The company has begun notifying affected customers. It is still determining how many individuals had identity documents exposed. Copies of identity documents can be used to prepare identity theft schemes and targeted fraud attempts. Affected customers should therefore exercise particular caution when dealing with inquiries relating to DigiCert or their certificates.
(Editorial Team)
