DigiCert breach exposes business customers’ contact information

DigiCert has disclosed a data breach affecting its business customers’ contact information, including names and email addresses. The incident concerns an internal system used to archive customer data, which was moved to a different network segment in February 2025 and inadvertently exposed to the internet. Attackers abused a self-registration feature in the system’s account manager—built for other purposes and not requiring MFA—to create a read-only account with access to archived data between 27 June and 2 July.

DigiCert blocked the unauthorized account on 2 July and, after reviewing in October, determined that the account had been used to access archived customer contact information, including names, email addresses, phone numbers and business addresses. In some cases, documents such as driver’s licences, passports and utility bills containing a name and address provided by customers were also impacted.

DigiCert emphasises that the access could not write records, act as a validation approver, or issue certificates, noting that the CA systems operate on their own secure network segments and were not affected by this external access.

According to DigiCert, the incident was initially investigated and remediated as an account-creation event. On 12 October, the company began suspecting that the unauthorised account might have accessed archived data and launched a formal investigation.

From mid-October, DigiCert implemented additional monitoring and alerting, verified or removed remaining non-DigiCert accounts, reset passwords for all business system users, deactivated the self-registration feature, and confirmed ownership of the business system alongside the enforcement of permission policies. DigiCert did not specify how many customers might have been affected, and SecurityWeek has not received a response from the company on this point.