DigiCert Breach: Self-Registered Accounts Read Archived Customer Records and Some Passports After a 2025 Migration Put a VPN-Only System Online
DigiCert is notifying customers that an unauthorised account read archived business contact data and some identity documents in mid-2026, while saying its CA services, CertCentral and issued certificates were not affected.
DigiCert, one of the world's largest certificate authorities, has started notifying customers that an unauthorised account read archived customer records, in some cases including passports, driver's licences and utility bills, from an internal business system. The root cause goes back to February 2025, when a server migration accidentally put a VPN-only system on the public internet. It then took the company until October 2026 to confirm that customer data had actually been accessed.
What Happened
According to DigiCert's incident report filed with the Mozilla root program and its customer notices:
- February 2025: a server migration made an internal business system, previously reachable only over VPN, accessible from the internet.
- The system had a self-registration feature intended for other applications, so outsiders could create accounts.
- June 2026: DigiCert found unauthorised accounts on the system. Because they weren't assigned to any application, it concluded they couldn't reach customer data and handled the matter as an account-creation issue.
- Later, a report through DigiCert's security research programme warned that outsiders could create accounts. DigiCert deployed fixes, but still did not realise data had been read.
- 19 October 2026: a deeper investigation confirmed that an unauthorised account had accessed customer information between 27 June and 2 July 2026.
DigiCert's own wording sums up the delay: the incident was "initially handled as an account-creation issue rather than a data-access event."
Technical Details
The failure combined three common mistakes:
- Exposure by migration. A system designed to sit behind a VPN ended up internet-facing, and nobody noticed for well over a year.
- Open self-registration. Anyone who found the system could sign up. Reports say no MFA was required.
- Broken authorisation. Accounts that weren't linked to any application should have had no access. An authorisation flaw nevertheless let them read the archive.
The access was read-only. DigiCert says the account "could not write records, act as a validation approver, or issue certificates."
What Data Was Exposed
- For affected customers: names, business email addresses, phone numbers and business addresses.
- For a smaller group: identity documents submitted during validation, such as driver's licences, passports, utility bills or other documents showing a name and address.
DigiCert has not said how many customers or individuals are affected. It says it is still reviewing the identity documents to determine exactly whose were exposed, and will notify those people when the review is done.
What Was Not Affected
DigiCert states that its certificate authority services, CertCentral and DigiCert ONE were not compromised, and that customer login credentials and issued certificates remain secure. No certificates were mis-issued as a result of this incident.
What DigiCert Has Done
- Restricted access to the affected system.
- Disabled self-registration.
- Added access controls and fixed the authorisation flaw.
- Began sending breach notifications to affected customers.
What To Do Now
If you are a DigiCert customer, or submitted identity documents for organisation or extended validation:
- Expect targeted phishing. The attacker knows real names, roles and business contacts, and possibly order history. Watch for emails about "validation problems", "certificate expiry" or "re-verification" that ask you to click a link or send documents.
- Verify through the portal. Check any certificate or validation request by logging in to your DigiCert account directly, never through a link in an email.
- Brief the people listed as contacts. Validation and billing contacts are the most likely to be targeted.
- Watch for identity misuse if your passport or driver's licence was among the submitted documents. Consider the identity-protection steps available in your country.
- Check your CAA records and Certificate Transparency monitoring as general good practice, so any unexpected certificate for your domains is spotted quickly:
dig +short CAA example.comWhy It Matters
Nothing in this incident touched DigiCert's core PKI. Still, it is an uncomfortable reminder that trust providers hold a lot of sensitive identity material, collected to prove that organisations are who they say they are, and they often keep it long after validation is finished.
The timeline matters as much as the bug. An exposure that lasted more than a year and a half, and an early warning that was classified as a nuisance instead of a breach, show how easily "no data access" becomes the default assumption. Two lessons apply to every organisation: re-check network exposure after every migration, and ask how long you really need to keep the identity documents you collect.
