DigiCert has disclosed a data breach after a server migration error exposed an internal business system to the internet, allowing unauthorized users to access archived customer information and sensitive identity documents.
The exposed information included customers' names, business email addresses, phone numbers and business addresses. In some cases, the records also contained personal identification documents, including driver's licences, passports and utility bills.
DigiCert has started notifying affected customers about the incident. The company is also reviewing archived identification documents to identify the individuals whose personal documents may have been accessed.
Server migration error led to unauthorized access
According to an incident report published on Mozilla's Bugzilla platform, the security issue originated in February 2025, when DigiCert migrated an internal business system to a different availability zone. The migration inadvertently made the system accessible from the public internet, although it was previously restricted to users connected through a virtual private network (VPN).
The exposed system contained a self-registration feature designed for other applications. This feature allowed external users to create accounts without requiring the usual internal authorization.
Although these newly created accounts were not assigned to any particular application, an authorization vulnerability allowed them to access archived customer information in read-only mode.
DigiCert discovered unauthorized accounts on the exposed system in June 2026. However, the company initially believed that these accounts could not access customer records because they had not been assigned to an application.
The company received a report through its managed security research program highlighting the possibility of external users creating accounts on the system.
DigiCert implemented security measures to restrict access and address the authorization issue. However, it did not immediately recognize that customer information had already been accessed.
An investigation confirmed that an unauthorized account had accessed archived customer records between June 27 and July 2, 2026. DigiCert confirmed the data breach on October 19, 2026.
The company acknowledged that the incident was initially treated as an account-creation issue rather than a potential data-access incident.
Customer information and identity documents exposed
The compromised records primarily contained business contact information shared with DigiCert during customer verification and other business processes.
However, some archived records also included sensitive identification documents submitted by customers. These documents could include government-issued identification, such as passports and driver's licences, as well as utility bills containing personal information.
DigiCert stated that the unauthorized account had read-only access and could not modify customer records, approve certificate validations or issue digital certificates.
Robust security measures by DigiCert
After the investigation, DigiCert disabled the self-registration feature, restricted access to the affected system and introduced additional access controls to prevent unauthorized users from accessing archived information.
The company also confirmed that its core certificate authority services, including CertCentral and DigiCert ONE, were not compromised. Customer login credentials and previously issued digital certificates also remain secure.
Read the original article:
DigiCert Hack Exposes Customer Details, Passports, and Driver’s Licences