DigiCert, a Utah-based certificate authority, said an internal business system mistakenly exposed to the internet let an outside account read customer data and identity documents. The Record and BleepingComputer reported the breach Nov. 5 and 6. The unauthorized access ran from June 27 to July 2, according to the company’s incident report.
Related: CISA Flags Actively Exploited SonicWall VPN Flaw, CVE-2026-19868.
What DigiCert said happened
The incident began in February 2025, when the system was moved out of a VPN-restricted network, DigiCert said in a post-mortem cited by The Record. The system included a self-registration feature meant for other applications, BleepingComputer reported. External users could use that feature to create accounts.
The accounts were not assigned to any application, but an authorization flaw let them read archived customer information, BleepingComputer reported. DigiCert determined on June 21 that the system was externally accessible and that an unassigned account had been created, The Record reported. The company said the issue was fixed by July 2.
DigiCert initially concluded that the accounts could not reach customer information, BleepingComputer reported. A further investigation confirmed on Oct. 19 that an unauthorized account had accessed the data. “The incident was initially handled as an account-creation issue rather than a data-access event,” DigiCert said, according to BleepingComputer.
What was exposed
The accessed data included customer names, business email addresses, phone numbers and business addresses, the company said. It also included identification documents such as driver’s licenses, passports and utility bills, where customers had supplied them.
BleepingComputer reported that the company described the affected data as a small portion of its archived customer records. DigiCert’s report does not say how many customers were affected, The Record reported. DigiCert told customers it was still reviewing identification documents to determine who was affected, according to a notification BleepingComputer published.
What DigiCert says was not affected
The unauthorized account had read-only access and could not modify records, approve certificate validations or issue certificates, DigiCert said, according to BleepingComputer. The company said its certificate authority services and its CertCentral and DigiCert ONE platforms were not compromised. Customer login credentials and issued certificates remained secure, it said.
“To our knowledge, there is no evidence of misuse of the information involved,” a DigiCert spokesperson told The Record. The spokesperson said the company had reported the incident to law enforcement. The spokesperson declined to say whether the attackers had contacted DigiCert.
Why it went undetected
DigiCert said the migration “was treated as an infrastructure change rather than a security change,” which would otherwise have triggered more detailed review, The Record reported. The system also had insufficient alerting for new account creation and request volume, the company said. The incident was reportable under rules issued by Mozilla, Google Chrome, Microsoft and Apple, according to The Record.
What happens next
DigiCert has restricted access to the system, disabled self-registration and added access controls, BleepingComputer reported. The company has begun sending breach notifications to affected customers. Social media users raised concerns that identity documents could be tied to specific certificates, The Record reported. For more coverage, see Technology and AI news.
Sources
- The Record: Certificate authority DigiCert reports data breach involving business customer info
- BleepingComputer: DigiCert data breach exposes customer information, identity documents
Read next in Technology
Most read this week
- Abdul El-Sayed and the Muslim Brotherhood Claims: What’s Confirmed and What Isn’t
- Stock Futures Erase a 2.4% Overnight Drop as Markets Digest Democrats’ Sweep of Congress
- Spain Transport Minister Óscar Puente Quits 26 Days Before Election Over Crash That Killed 69
- Boston Plans to Close 3 Schools in 2028 as Enrollment Drops as Much as 58%
- GM Korea’s Sales Jump 26.6% on Chevrolet Exports as Hyundai Slips 6.3% and Korean Factory Growth Cools
Latest
- UN Gaza Funding Timeline: A $4 Billion Appeal, Then Food Cuts, Then New Pleas for Cash
- Taiwan Detains Small Communist Party’s Chief Over Alleged Chinese Funding Before Nov. 28 Elections
- France Says Europeans Will Join U.S.-Mediated Ukraine Talks in Abu Dhabi on Nov. 10–11
- Russian Strikes Cut Power to About 850,000 in Ukraine as Zaporizhzhia Plant Loses Outside Supply
- Heavy Rain Floods Tents Across Gaza as Aid Groups Warn of Worsening Conditions