DigiCert has disclosed a data breach involving a limited portion of archived customer information after a server migration accidentally exposed internal business systems to the Internet. The unauthorized access may have exposed names, work contact details, addresses, and, for some customers, identity documents such as driver’s licenses, passports, and utility bills.
The certificate authority has begun notifying affected customers. Cloud architect Fabian Bader shared a copy of the notification on X.
“Thank you @digicert. Your data breach may have been ‘limited’ to my complete PII data and the verification documents I submitted for my certificate,” Bader wrote.
Archived customer data exposed
DigiCert said the affected information was limited to names, work email addresses, phone numbers, and work addresses provided to the company. Depending on the customer, the records may also have included identification documents, including a driver’s license, passport, utility bill, or another document showing the person’s name and address.
“The information involved was limited to the name, work email address, phone number, and work address shared with DigiCert and, if provided, may have included identification documents such as a driver’s license, passport, utility bill, or other document bearing the name and address,” the data breach notification states.
DigiCert said it is still reviewing the identification documents involved to determine who was affected and will notify additional customers when that review is complete.
Server migration led to unauthorized access
An incident report published on Mozilla’s Bugzilla platform says a server migration in February 2025 accidentally exposed internal business systems to the Internet. The systems had previously been accessible only through a virtual private network (VPN).
One exposed system included a self-registration feature that allowed external users to create accounts for other applications. Although those accounts were not assigned to specific applications, an authentication flaw allowed them to access archived customer information in read-only mode.
DigiCert first discovered fraudulent accounts on the exposed systems in June 2026. The company initially determined that the accounts were not assigned to the application and therefore could not access customer information.
DigiCert later received a report through a managed security investigation program warning that external users might be creating accounts on the system. The company applied security fixes to restrict access and address the authentication flaw, but was not aware at the time that archived data had been accessed.
Further investigation confirmed on October 19, 2026, that a fraudulent account had accessed customer information between June 27, 2026, and July 2, 2026.
“This incident was initially treated as an account creation issue rather than a data access event,” DigiCert acknowledged in the report.
Certificate services were not compromised
DigiCert said the fraudulent account had read-only access and could not modify records, approve certificate validations, or issue certificates.
The company is restricting access to the affected systems, disabling self-registration, and adding additional access controls.
DigiCert also said its certificate authority services, CertCentral, and DigiCert ONE platform were not compromised. Customer login credentials and issued certificates remain secure, according to the company.
BleepingComputer has contacted DigiCert with additional questions about the incident, including how many people were affected, and will update this article if the company responds.
Source: www.bleepingcomputer.com