DigiCert Confirms Unauthorized Access to Internal Business System; Some Customer Contact Details and Identity Documents Potentially Exposed

What Happened

In a Mozilla Root Program compliance incident report on Bugzilla, DigiCert explained that during an infrastructure migration in February 2025, an internal business system not intended for public exposure was moved outside a VPN-restricted segment, inadvertently making its account registration endpoint accessible from the internet ^[1].

The company stated that on June 21, 2026, it determined the system was externally reachable and that unassigned accounts had been created, deploying an authorization fix on July 2; the system's authorization model had not originally accounted for self-registration scenarios ^[1].

According to The Record, DigiCert confirmed on October 19 that the database had been accessed starting June 27 and classified it as a reportable incident; a spokesperson stated that law enforcement had been notified and that, to the company's knowledge, there is no evidence the information has been misused ^[2]. The Register also reported that the company has begun notifying affected customers, though the number of affected individuals has not been disclosed ^[3].

Scope of Impact

DigiCert wrote that the incident affected only a small subset of archived data, consisting of names, business email addresses, phone numbers, and business addresses shared with DigiCert, and where provided by the customer, potentially driver's licenses, passports, utility bills, or other documents containing names and addresses ^[1].

The company emphasized that this access did not allow writing records, acting as a validation approver, or issuing certificates; CA systems reside in a separate secure network segment and were unaffected by the external access, and customer login credentials and issued certificates remain secure and valid ^[1].