DigiCert breach exposed customer IDs after botched server move

Certificate authority DigiCert has disclosed a data breach in which an unauthorized user viewed archived customer records. Names, business email addresses, phone numbers and business addresses were exposed, and for some customers, copies of passports, driver's licenses and other identity papers.

The trouble started in February 2025, when DigiCert relocated an internal business system that had been reachable only through a VPN. According to the company's incident report, filed on Mozilla's Bugzilla platform, the move left that system open to the public internet, and it stayed that way for more than 16 months before anyone at DigiCert noticed.

DigiCert calls the affected records a small proportion of its archive but has not said how many customers or individuals are involved. It has started notifying customers and says it is still reviewing identity documents to pin down whose papers were viewed, with further notices to follow.

The company says its certificate authority operations, CertCentral and DigiCert ONE were unaffected, and that customer credentials and issued certificates remain secure. The intruder's account was read-only, could not alter records or approve validations, and DigiCert found no sign it was used to issue, revoke or validate certificates.

How the intruder got in

Once online, the archive carried a sign-up option that was meant for other applications and should never have been active there. Outsiders could open accounts on it without multifactor authentication, and a separate authorization flaw let those accounts read archived customer data even though they were not tied to any application.

DigiCert spotted unauthorized accounts on June 18, 2026, but judged them harmless for that reason. Three days later, a researcher in its managed security research program warned that outsiders could create accounts. The company did not close the hole until July 2, and an unauthorized account had been reading records since June 27.

DigiCert has acknowledged that it first treated the episode as an account-creation problem, not a data exposure. It did not start checking whether customer information had actually been viewed until October 12, and confirmed the access on October 19. The company's own postmortem says the server move never received a proper security review and that monitoring failed to catch the suspicious activity.

Repairs and reaction

Since mid-October, DigiCert has turned off self-registration, tightened network access, added monitoring and alerts, reset passwords for every user of the business system, and verified or removed remaining accounts that did not belong to its staff.

Cloud architect Fabian Bader posted a copy of his breach notice on X, objecting to the company's description of the leak as limited.