DigiCert confirmed unauthorized access to an archive containing business contact details and identity documents supplied by customer representatives. Most affected records held names, work email addresses, phone numbers, or business addresses. A smaller share included documents such as passports, driver’s licenses, or utility bills. DigiCert has not disclosed how many customers were affected. The Record
The exposure began on February 4, 2025, when DigiCert moved the application out of a VPN-restricted network segment. The move exposed a self-service registration endpoint intended for other applications. Accounts created through that endpoint bypassed the usual multifactor authentication requirement and received read-only access. Those permissions still let them read archived records. DigiCert’s incident report
DigiCert spotted unfamiliar accounts on June 18, 2026. A reviewer assumed they had no access because they had no application assignment. Investigators later traced unauthorized access to June 27 through July 2, when an authorization patch closed the gap. DigiCert confirmed the breach on October 19 and filed a preliminary report the next day. Incident timeline
DigiCert says its certificate systems ran on separate network segments and the account lacked permission to issue certificates. The company notified affected customers and reported the incident to law enforcement. The Record
DigiCert later disabled self-registration across the affected application’s instances and moved the remaining public endpoints to private load balancers. The company also added alerts for unexpected account creation and permission changes. Remediation and follow-up
Comments (0)