DigiCert, one of the largest certificate authorities, has begun notifying customers that an unauthorized account read archived customer information from one of its internal business systems. According to DigiCert’s incident report on Mozilla’s Bugzilla, the system was moved on February 4, 2025 from a VPN-restricted network segment to one that was reachable from the internet. An account-registration feature meant for other uses became available on it, so outsiders could create accounts. Those accounts skipped the multi-factor authentication DigiCert normally requires and were read-only by default, but an authorization flaw still let them reach archived data.
DigiCert says an unauthorized account accessed the data between June 27 and July 2, 2026. The company learned on June 21 that outsiders could create accounts, via a report from its managed security research program, and shipped an authorization fix on July 2, but did not realize at the time that archived data had been read. It confirmed the data access on October 19; in its words, the incident “was initially handled as an account-creation issue rather than a data-access event.” Most of the data was business contact details (names, business email addresses, phone numbers and business addresses). For a small minority of customer accounts it also included a document the customer had provided, such as a driver’s license, passport, utility bill or similar document showing a name and address. DigiCert says the access could not modify records, approve validations or issue certificates, and that its certificate authority services, CertCentral and DigiCert ONE were not affected. The company has not published how many people were affected; a commenter on the Bugzilla report asked for those numbers on November 5.
This is a different incident from the support-system intrusion and stolen code-signing certificates we covered in July: see Hackers Breached DigiCert and Stole Code-Signing Certificates.
How to check if you’re affected
Affected products are not DigiCert’s certificates or CA services; the exposed data sat in a business system that archives the contact and identity information customer representatives provide to DigiCert to validate their identity. Check whether you or your organization submitted such details (for example, a company representative validating a certificate order) and whether you received a DigiCert data-breach notification. BleepingComputer says cloud architect Fabian Bader shared a copy of the notification on X. DigiCert says it is still reviewing identification documents to determine who was affected and will notify those people when the review is complete, so a missing notice today is not confirmation that your documents were not accessed.
DigiCert’s report says no action is needed from customers regarding active certificates, and that customer login credentials and issued certificates remain secure. For the exposed contact details and any ID documents, treat unexpected emails or calls that mention DigiCert or your certificate orders with extra caution; that is general advice, not guidance from DigiCert.