DigiCert Exposure Exposed Archived Customer Records and IDs

DigiCert disclosed that an internal data exposure during an infrastructure migration allowed an unauthorised party to access a subset of archived customer records held on an internal platform. The exposure stemmed from a self-registration feature that became accessible through a migrated internal archival tool moved from a VPN-restricted segment to an externally accessible availability zone.

Investigators found the intruder had read-only access and could view archived files but could not issue or modify certificates, and no PKI operations were affected. The breach was detected after non-DigiCert accounts appeared on the server on 18 June 2026, with a Web Application Firewall subsequently deployed.

A later alert in early July 2026 indicated external users could still register accounts; DigiCert deployed an authorisation patch on 2 July 2026 and, during a deeper log review in October 2026, confirmed the account had viewed archived files prior to the patch.

Affected were DigiCert customers whose verification and contact records resided in the internal archive system. The company stated that a small minority of accounts included additional personal data, such as documents used for identity verification (for example, a driver’s licence, passport, utility bill, or other document with name and address).

The Mozilla Bugzilla report cited by DigiCert notes that no certificates were issued, modified or revoked as a result of the incident, and CA servers on separate network segments remained untouched.

In response, DigiCert conducted a root-cause analysis using the Five Whys, issued patches to restrict access, deactivated self-registration across internal instances on 24 October 2026, moved remaining endpoints behind private-IP load balancers, and added application-level SIEM alerts; it also tightened internal network-access change controls. Customers are advised to monitor for targeted phishing and to verify unexpected DigiCert requests through official channels.