DigiCert left a customer archive open to the internet for 16 months

DigiCert left a customer archive open to the internet for 16 months

1 November 2026: DigiCert says an internal system archiving the details customers supply to prove their identity was reachable from the internet from February 2025, and that one account read archived data for about five days this summer. Most of it was business contact details, but a small minority of customers also had a driver's licence, passport or utility bill in the archive.

Not yet independently verified. DigiCert has not said how many customers were affected, and we did not find a customer notice on its own site. The Register dates the first rogue account to 18 June, while DigiCert's report starts from 21 June. We will update this when it can be confirmed, and remove this note.

How a network move exposed the archive

The company's report, filed with Mozilla's root programme, traces the problem to 4 February 2025. The system was moved from a VPN-restricted segment to another availability zone, which left it externally reachable. An account registration feature meant for other uses then became available, and accounts created that way skipped multi-factor authentication. They were read-only by default, but could read the archive.

From 21 June 2026, DigiCert began working out what it had found: the reachable system and an account nobody had been assigned. An authorisation fix went in on 2 July. Unauthorised access to archived data ran from about 27 June to 2 July.

The gap after that is the part customers may ask about. DigiCert began checking for data access on 12 October, and on 19 October confirmed that a subset of the archive had been read and treated the event as reportable. That is more than three months after the fix.

What was read and what was not

Mostly it was names, business email addresses, phone numbers and business addresses. The ID documents held a name and address and came from customers who had provided them for validation. DigiCert has not published a count.

The company draws a firm line around its certificate business: "The access could not write records, act as a validation approver, or issue certificates." It says certificate authority operations, CertCentral and DigiCert ONE were unaffected, and that active certificates need no action. SecurityWeek's summary adds extra monitoring since mid-October, removal or verification of remaining outside accounts, password resets for all users of the business system and an end to self-registration.

What certificate customers should do

The Register reports that affected customers are being emailed. Those who do not get a message can still act, because the people most likely to be targeted next are those named as certificate contacts in a validation file. Staff handling renewals should expect convincing phishing that quotes real order details, and should confirm any request to change a contact or domain validation through a known channel.

A company that sent an employee's passport for validation has a data protection question of its own, and may need to assess whether that person must be told once DigiCert confirms what it held. Procurement teams with DigiCert on a critical supplier list can ask for the affected fields in writing.

Because the report is on a public Mozilla bug, root programme staff can question it there, and later answers may add to this account.

Company profile on TrustList: DigiCert

Sources

• DigiCert incident report on Mozilla Bugzilla 2084460: Unauthorized access to business system, opened 21 October 2026, full report 1 November 2026, 1 November 2026
• SecurityWeek: DigiCert data breach impacts business customer information, 6 November 2026, 6 November 2026
• The Register: DigiCert admits 16-month security lapse, 6 November 2026, 6 November 2026