DigiCert breach: a migrated server left customer ID documents exposed
DigiCert says an internal system holding customer validation records was reachable from the internet, and that an outside account read customer information between 27 June and 2 July 2026, including some ID documents. It says no certificate operations were affected.
Illustration: UtiBox
On this page 7 sections
DigiCert, one of the world’s largest certificate authorities (the companies that issue the certificates behind the padlock in your browser), has disclosed that an outside account read customer information, including identity documents some customers had supplied for verification. DigiCert filed its incident report with Mozilla, which oversees the certificate authorities trusted by Firefox.
What happened
According to DigiCert’s report:
- An internal business system that archives the information customers provide to validate their identity had been moved, during an earlier server migration, from a VPN-restricted network to a location that was reachable from the internet.
- An account registration feature meant for other uses could be reached through it. Accounts created this way skipped the multi-factor authentication DigiCert normally requires and were given read-only access by default.
- That was enough to read archived customer records.
The 2026 timeline
- 27 June to 2 July 2026: an unauthorised account accesses customer information.
- 2 July 2026: DigiCert releases a fix for the authorisation problem.
- 19 October 2026: DigiCert confirms the unauthorised access and decides it is a reportable event.
- 20 October 2026: DigiCert files its preliminary incident report with Mozilla, followed by a full report.
What data was exposed
DigiCert says most of the data was business contact information: names, business email addresses, phone numbers and business addresses. For a small minority of accounts, the records also included customer-provided documents, such as a driver’s licence, passport or utility bill showing a name and address. These are typically supplied to validate an organisation or extended validation (EV) certificate. DigiCert hasn’t published the number of people affected.
Are certificates affected?
No, according to DigiCert. Its report states that “no certificate operations were impacted”. The account could not write records, act as a validation approver or issue certificates, and DigiCert says its certificate authority systems, CertCentral and DigiCert ONE weren’t affected. Nothing suggests you need to reissue a certificate because of this incident.
What to watch for
The leaked data (names, business contact details and, for some, ID documents) is exactly what makes a convincing phishing email. If you buy certificates from DigiCert, be wary of messages asking you to “re-verify” your organisation, approve an unexpected validation request or pay an invoice through a new link. Sign in to your DigiCert account directly rather than through a link in an email.
Want to confirm a certificate is healthy without signing in anywhere? Our SSL Certificate Checker reads the certificate your site actually serves and shows who issued it, which names it covers and how many days it has left.
The lesson for the rest of us
Migrations are where security assumptions quietly break. A system designed to sit behind a VPN often has features, like open self-registration, that are only safe because nobody outside can reach them. When you move infrastructure, check what has become reachable from the internet, and require multi-factor authentication on every path in, not just the main login page.
Sources
Related
More from Server & Security News
A fake job interview opened the door to Binance’s $6.3 billion heist
The FBI says North Korea stole more than $6 billion from Binance on or about 29 October. Binance’s incident report says it began with fake job interviews and a booby-trapped coding test. Here’s how…
