DigiCert has disclosed that an unauthorized account read archived customer information on an internal business system, including driver’s licenses, passports and other documents that some customer representatives had provided so the certificate authority could validate their identity.
In an incident report filed in Mozilla’s public bug tracker, DigiCert said most of the data was limited to names, business email addresses, phone numbers and business addresses. A “small minority” of customer accounts also included a document such as a driver’s license, passport, utility bill or other item showing a name and address. The company has begun notifying customers and says it is still reviewing the identification documents to determine who was affected. It has not said how many people that includes.
The exposure began on February 4, 2025, when an infrastructure migration moved the system from a VPN-restricted network segment to an availability zone that could be reached from outside. That made an account registration feature intended for other uses available on the system. Accounts created that way were read-only and were not subject to the multi-factor authentication DigiCert otherwise requires, but they could reach archived data.
An internal team noticed non-DigiCert accounts on June 18, 2026, and concluded that they had no access to data because they were not assigned to any application. A report through DigiCert’s managed security program followed three days later, and the company released an authorization fix on July 2. It first suspected on October 12 that archived data had been accessed, and confirmed it on October 19. The investigation put the access window at June 27 to July 2. “The incident was initially handled as an account-creation issue rather than a data-access event,” the report says.
DigiCert says the access could not write records, act as a validation approver or issue certificates, and that a review of logs found no validation, issuance or revocation activity linked to the account. It says its certificate authority services, CertCentral and DigiCert ONE were unaffected, and that customer login credentials and issued certificates remain secure.
The company has since disabled self-registration on all instances of the system, moved its remaining externally accessible endpoints behind private load balancers and internal hostnames, and required security sign-off for network access changes on internal tools. On Thursday it reported completing automated alerts for unexpected account creation and permission changes. The report lists the migration’s treatment as an infrastructure change, rather than a security change needing more detailed review, as the reason the exposure was not caught sooner.
Sources: Mozilla Bugzilla, BleepingComputer
–
By the ID Tech Editorial Team
