"Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate," wrote cloud architect Fabian Bader after DigiCert began notifying customers about an exposure of archived records and identity documents.
How the system became internet-accessible
DigiCert says the incident traces to a February 2025 server migration that "mistakenly exposed an internal business system to the internet" that had previously been available only via VPN, according to an incident report posted on Mozilla's Bugzilla platform. That exposed system contained a self-registration feature intended for use by other applications, which allowed external users to create accounts.
Although those self-created accounts were not assigned to specific applications, an authorization flaw on the system permitted them to read archived customer information. The company later acknowledged the problem was first treated as an account-creation issue rather than a data-access event.
What data was accessed
DigiCert has said the breach affected a "small portion" of its archived customer data. The company’s breach notification states: "The information involved was limited to names, business email addresses, phone numbers, and business address shared with DigiCert and, if provided, may have included an identification document such as a driver’s license, passport, utility bill or other document with name and address." For some individuals, the exposed records included personal identification documents.
The company also reported that the unauthorized account had read-only access and could not modify records, approve certificate validations, or issue certificates. DigiCert further emphasized that its certificate authority services, CertCentral, and the DigiCert ONE platform were not compromised, and that customer login credentials and issued certificates remain secure.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTimeline: discovery, fixes, and confirmation
- February 2025 – A server migration allegedly exposed the internal system to the internet, according to the Bugzilla incident report.
- June 2026 – DigiCert discovered unauthorized accounts on the exposed system but initially concluded they could not access customer information because they were not assigned to an application.
- June 27 to July 2, 2026 – DigiCert now says customer information was accessed by an unauthorized account during this interval.
- October 19, 2026 – A further investigation confirmed that customer information had been accessed between June 27 and July 2.
Following the June reports, DigiCert deployed security fixes to restrict access to the system and to address the authorization flaw, but later acknowledged it did not realize archived data had been accessed until the October investigation.
DigiCert's immediate mitigations and customer outreach
After confirming the data access, DigiCert restricted access to the affected system, disabled self-registration, and added additional access controls. The company has begun sending data breach notifications to affected customers and is reviewing identification documents to determine who was impacted; it says it will notify those people once the review is complete.
Cloud architect Fabian Bader made public a copy of DigiCert’s notification on X, drawing attention to the inclusion of PII and potential verification documents in the exposed records.
What this means for technologists, affected customers, and procurement leaders
- Technologists and security teams: A server migration that changed access controls is central to this incident — teams will note the operational risk of exposing internal systems post-migration and the danger of self-service features combined with authorization flaws. The event highlights the need to verify access restrictions after infrastructure changes and to monitor for unexpected account capabilities.
- Affected customers and individuals who submitted identity documents: Those notified should treat the presence of driver's licenses, passports, or utility bills in the exposed records as a material risk to personal identity data and watch for follow-up notifications from DigiCert as the company completes its document review.
- Procurement and enterprise risk managers who rely on certificate authorities: The incident is a reminder to track service-provider incident communications and to verify second-party security controls where archived customer records or verification documents are retained.
BleepingComputer has contacted DigiCert with questions including how many people were impacted and said it will update its story if DigiCert responds. For now, the record is a mix of procedural fixes and ongoing outreach: DigiCert says key certificate services and credentials remain secure, but a migration error and an authorization flaw exposed archived records — including sensitive identity documents for some — and it took months for a full confirmation that data had been read.
