DigiCert Says a Server Migration Left Its Customer Archive, With Some Passports and Driver's Licenses, Open for Almost 17 Months. It Has Not Said How Many Customers Were Exposed.
If your company buys certificates from DigiCert, find out whether you got a breach notice, and if you ever sent DigiCert a passport, driver's license or utility bill to prove who you are, treat that document as exposed and tell the person it belongs to. DigiCert reported on Mozilla's Bugzilla tracker that an internal archive of customer information was reachable from the internet after a server migration, and that outside accounts read archived data between June 27 and July 2, 2026. SecurityWeek covered it on November 6. DigiCert says no certificates were issued and its certificate authority systems were not affected.
This is not the incident we wrote about in May, when DigiCert staff were phished through a support chat. That was an attack. This one is a misconfiguration, with no malware.
What DigiCert reports
DigiCert filed an incident report on Mozilla's Bugzilla (bug 2084460), as root programs at Mozilla, Chrome, Microsoft and Apple require for events like this. Here is what it says.
The system is an internal business archive, running its own instance of an account manager platform, that holds business contact details and some personal information customers provided. The preliminary report described it as holding information customers gave "to validate their identity." The full report calls it an archive.
On February 4, 2025 the system was migrated off a VPN-restricted network segment, which made it reachable from outside. A self-registration endpoint built for other purposes was now exposed with it. Accounts created through that endpoint needed no multi-factor authentication and defaulted to read-only. DigiCert says they could read archived data but could not write records, act as a validation approver or issue certificates.
The data access window runs from June 27 to July 2, 2026. DigiCert released an authorization patch to production on July 2.
DigiCert says the exposed data is mostly business contact information, meaning names, business email addresses, phone numbers and business addresses. In a small minority of accounts it also includes documents customers provided, such as a driver's license, passport, utility bill or another document showing a name and address.
DigiCert says its certificate authority, CertCentral and DigiCert ONE were not affected, that no certificates were issued, modified or revoked, and that its log review found no validation, issuance or revocation actions tied to the unauthorized accounts. A spokesperson told The Record that "to our knowledge, there is no evidence of misuse of the information involved." DigiCert says it contacted affected customers with information specific to them and reported the incident to law enforcement.
The timeline, with the gaps
The report's dates are worth reading closely, because the detection story is slow.
February 4, 2025: the system moves to an externally reachable network zone.
June 18, 2026: an internal team sees accounts that do not belong to DigiCert and concludes they had no data access. The system is put behind a web application firewall to block external account creation.
June 21: DigiCert's managed security program reports possible external account creation.
June 24: DigiCert verifies that account creation is possible.
June 27: start of the data access window.
June 30 to July 2: root cause found, patch built and released.
October 12: DigiCert first suspects unauthorized access to archived data.
October 19: it determines the event is reportable and confirms the access window.
October 20: preliminary report filed. October 24: self-registration switched off.
From the migration to the end of the access window is almost 17 months. From the end of that window to a reportable finding is about 15 weeks. DigiCert says the first review wrongly concluded that accounts with no assigned application could not read data. The report does not explain what led to the October 12 suspicion, and a Bugzilla participant asked about it without an answer.
Why it happened, in DigiCert's words
The report names three contributing causes. The February 2025 network change was treated as an infrastructure change, not a security change, so no security review of the new attack surface took place. Monitoring was not reassessed after the migration, and the system had no alerts for new accounts or unusual request volume. The authorization model did not account for self-registration, so accounts with no assigned application could still read data.
Those are ordinary failures, and any team can have them. A system that is moved is a new system from a security standpoint, and nobody was assigned to ask. DigiCert has since added file-access and request-volume alerts, reset all system users' passwords, restricted hostnames to VPN traffic, moved endpoints to private addresses, required security sign-off for network changes, run a penetration test and named one owner for the system's security posture.
What is still unanswered
DigiCert has published no count of customers or records. Its report says supporting data contains personal data and offers summary statistics to root program representatives on request. It has not said whether the exposed documents were used in subscriber validation, a question a Bugzilla participant asked twice and that remained unanswered when we read the page. The report does not mention private keys. DigiCert has not said who the attackers were, whether they made any demand, or whether the data has been published or sold. DigiCert did not respond to The Record's request for comment, and SecurityWeek says its inquiry had not been answered.
On social media, people shared breach notification emails they received from DigiCert, and some worried that attackers could link identity documents to specific certificates. That worry is a reaction to the report and not a finding in it.
What to do
Find the notice. If you hold DigiCert certificates and did not receive one, ask your account manager whether your organization is affected. DigiCert says it contacted affected customers, but does not say how many that was.
List who sent identity documents for organization or extended validation. Tell those people that a passport, license or utility bill may have been exposed, and let them decide on credit monitoring or a fraud alert.
Expect DigiCert-themed phishing that uses real names, companies and addresses. Open CertCentral by typing the address yourself, not from an email, and call your known contact before acting on a request to re-verify or re-submit documents.
Check your account for orders, users or API keys you do not recognize. DigiCert says the attacker accounts could not issue certificates, so this is a precaution.
If you run a certificate program, add one question to your vendor review: when a system moves networks, who signs off on its security? DigiCert's own answer, now written down, is that nobody did.
Indicators
None. The report describes a misconfiguration and a self-registration feature, not attacker infrastructure. We did not add anything to the feed.
Limits
We read DigiCert's report on Bugzilla, SecurityWeek and The Record. We did not see the notification emails, so we cannot say what they contain or whom they went to. We cannot confirm the exposure window beyond DigiCert's own dates, and the report lists two action items as "ongoing" that its own comments call complete. DigiCert has not published a number of affected customers, so we do not offer one.
Five percent of this is wrong somewhere. It always is. A customer count, or an answer on validation, would change what to tell your team.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments