DigiCert

Summary

DigiCert suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to archived customer information and identity documents. The exposed records included names, business email addresses, phone numbers, and business addresses, with some records also containing personal identification documents such as driver's licenses, passports, and utility bills. An authorization flaw let externally created accounts access the data in read-only mode, though the company initially treated the issue as account creation rather than data access. The organization confirmed its certificate authority services, platforms, customer login credentials, and issued certificates remained secure, and it has since restricted access, disabled self-registration, and added additional access controls.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

DigiCert experienced a data breach stemming from a February 2025 server migration that mistakenly exposed an internal business system to the internet, a system that had previously been accessible only through a VPN. The exposed system included a self-registration feature intended for use by other applications, which allowed external users to create accounts even though those accounts were not assigned to any specific application. An authorization flaw associated with these accounts permitted read-only access to archived customer information. DigiCert first detected unauthorized accounts on the exposed system in June 2026 but initially concluded that the accounts could not access customer information because they were not tied to an application. The company later received a report through its managed security research program warning that external users could create accounts on the system. In response, DigiCert deployed security fixes to restrict access to the system and to address the authorization flaw, though it did not realize at that time that archived data had already been accessed. A further investigation concluded on October 19 that an unauthorized account had accessed customer information between June 27 and July 2, 2026. DigiCert acknowledged that the incident was initially handled as an account-creation issue rather than as a data-access event.

The breach affected a small portion of DigiCert's archived customer data, exposing names, business email addresses, phone numbers, and business addresses. For some individuals, the exposed records also contained personal identification documents, including driver's licenses, passports, and utility bills. DigiCert began sending data breach notifications to affected customers, and cloud architect Fabian Bader shared a copy of the notification on X. In the notification, DigiCert stated that it was still reviewing identification documents to determine who was affected and would notify those individuals once the review was complete. The notification specified that the information involved was limited to names, business email addresses, phone numbers, and business addresses shared with DigiCert, and that if provided, it may have included an identification document such as a driver's license, passport, utility bill, or other document with name and address. DigiCert confirmed that the unauthorized account had read-only access only and could not modify records, approve certificate validations, or issue certificates.

DigiCert restricted access to the affected system, disabled self-registration, and added additional access controls. The company stated that its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and that customer login credentials and issued certificates remain secure. BleepingComputer contacted DigiCert to ask further questions about the incident, including how many people were impacted, and indicated it would update the story if a response was received.

Sources

Sources available to members: 1 source.