DigiCert data breach exposed some customers' ID documents

DigiCert, one of the largest certificate authorities, has confirmed unauthorised access to part of an internal archive holding information its customers handed over to prove who they are. In its incident report to the browser root programmes, the company says most of the data was business contact details, but that a small minority of customer accounts also held a passport, driver's licence, utility bill or other document showing a name and address.

Customers were receiving notices by Wednesday. Security researcher Troy Hunt, who runs the breach notification service Have I Been Pwned, posted the email he received, and Bitcoin developer Jameson Lopp said he had been notified too. DigiCert says certificate issuance, CertCentral, DigiCert ONE, customer logins and issued certificates were not affected, and that customers need to take no action on their certificates.

How the archive was exposed

The cause goes back to February 4, 2025, according to DigiCert. An infrastructure migration moved the archive system, meant to be reachable only over a VPN, into a network zone that was reachable from the internet. The system ran an account manager whose self-service registration feature, built for customer sign-up elsewhere, had inadvertently been left available to it; the migration made that sign-up reachable from outside. Accounts created through it skipped the multi-factor authentication DigiCert requires of staff, were read-only and had no application assigned, but could still read archived data. DigiCert says one account created this way accessed a small proportion of the archive.

DigiCert says the migration was treated as an infrastructure change, not a security change, so it got no security review of what it exposed, and the system had insufficient alerting for new accounts or unusual request volumes. In the report, DigiCert wrote: "Authorization for a business system must not be delegated to its network position."

Timeline

According to the timeline DigiCert published, on June 18 staff noticed accounts on the system that did not belong to DigiCert, but concluded that without an assigned application they had no data access. On June 21 a report from its managed security research programme flagged that outsiders could create accounts. DigiCert shipped an authorisation fix on July 2 that cut unassigned accounts off from the archive.

It did not suspect that data had actually been read until October 12. On October 19 it confirmed unauthorised access to a subset of the archive and established the access window as June 27 to July 2, from file access and request volume logs. In the report it says the incident "was initially handled as an account-creation issue rather than a data-access event." The account could not write records, approve validations or issue certificates, and DigiCert says its logs show no validation, issuance or revocation activity tied to it.

What is still unknown

DigiCert has not said who created the account, and its public report gives no count of affected people, organisations or documents. It says it can share summary statistics with root programme representatives on request. Cybersecurity News reports the email told customers DigiCert was reviewing the identity documents and would notify affected people once that review is complete.

Two action items in the report, a final review of alerting for unexpected account creation and an audit confirming no system origin is reachable from outside, are due on November 6.