Certificate authority DigiCert says an outsider read archived customer records, in some cases including driver's licenses and passports, after a 2025 network change left an internal business system reachable from the internet.
The exposed data included customer names, business email addresses, phone numbers and business addresses. For some customers, it also included identity documents they had submitted, such as driver's licenses, passports and utility bills. The Utah-based company has not said how many people were affected.
DigiCert says the intruder could not issue certificates, change records or act as a validation approver. Its certificate authority services and its CertCentral and DigiCert ONE platforms were not compromised, the company says, and customer login credentials and issued certificates remain secure.
How the system was exposed
The trouble began in February 2025, when the business system was moved off a network that could be reached only through a VPN. DigiCert says the migration was handled as an infrastructure change rather than a security change, so it never got the more detailed review and sign-off a security change would have required.
The system had a self-registration feature built for other purposes that did not require multifactor authentication. An outsider used it to create an account, and although that account was not tied to any application, an authorization flaw gave it read-only access to archived customer data.
A delayed discovery
DigiCert found the system was unintentionally exposed, and that an unassigned account had been created, beginning on June 21, 2026. It first concluded the account could not reach customer information. After a report through its managed security research program, the company deployed fixes and blocked the account on July 2.
Suspicion that archived data had been read surfaced on October 12, and on October 19 the company confirmed the account had accessed customer information between June 27 and July 2. DigiCert called it a reportable event under rules issued by Mozilla, Google Chrome, Microsoft and Apple, and posted a detailed post-mortem on Mozilla's Bugzilla platform.
The incident was initially handled as an account-creation issue rather than a data-access event
DigiCert
The company acknowledged the system lacked sufficient alerting for new accounts created through the exposed endpoint. Since mid-October, it has added monitoring and alerts, removed or verified outside accounts, reset passwords for all business system users and switched off self-registration.
Customers notified
DigiCert has begun sending breach notices and says it is still reviewing identification documents to determine who was affected. A company spokesperson said there is no evidence of misuse, that the incident was reported to law enforcement, and declined to say whether the attackers have contacted DigiCert.
The notices drew criticism online. Cloud architect Fabian Bader shared his on X, mocking the idea that the leak was limited, and other posts raised concern that attackers could link personal documents like passports to specific certificates.
