DIGICERT DISCLOSES CUSTOMER DATA BREACH AFTER INTERNAL BUSINESS SYSTEM REMAINED EXPOSED TO INTERNET FOR MORE THAN A YEAR

LEHI, UTAH — DigiCert, a major provider of digital certificates and internet security services, has disclosed a security breach involving unauthorized access to an internal business system containing customer contact information and personal identification documents. The incident originated from a February 2025 infrastructure migration that unintentionally exposed a previously restricted system to the internet. Unauthorized access to archived customer records occurred between June 27 and July 2, 2026, but the company did not confirm the data breach until October 19, according to its formal incident report published through Mozilla’s certificate authority compliance program.

DigiCert provides digital certificates used to authenticate websites, support encrypted communications, and establish trust between online services and users. The company also operates certificate management and enterprise security platforms. Its role in internet security makes the protection of customer identity information particularly important, especially when that information is collected to verify individuals representing organizations requesting digital certificates.

The security failure began on February 4, 2025, when DigiCert moved an internal business system from a virtual private network (VPN)-restricted environment into a different availability zone. The migration unintentionally made the system accessible from outside the company’s intended network boundaries. The affected application was designed to archive information supplied by customers, including business contact details and documents submitted by representatives to establish their identities.

The exposed system relied on an account management platform that DigiCert also used for other applications. A self-registration feature intended for different purposes became accessible through the internal business system, allowing outside users to create accounts without the multifactor authentication normally required for authorized personnel. Although the newly created accounts were not assigned to an application and were configured for read-only access, an authorization weakness allowed them to retrieve archived records.

DigiCert’s internal security team observed unauthorized accounts on June 18, 2026, but initially concluded that the accounts could not access information because they were not associated with an assigned application. The company placed the business system behind a web application firewall, blocking new external account creation through that route. On June 21, DigiCert received a report through its managed security research program identifying the possibility of account creation through external access, and engineers verified the issue on June 24.

Investigators later established that an unauthorized account accessed archived customer information beginning June 27. Engineering personnel identified the account creation problem on June 30, prepared a corrective software patch on July 1, and deployed the authorization fix on July 2. That update prevented accounts without an assigned application from accessing the archived data, ending the confirmed period of unauthorized access. At the time, DigiCert had not established that the account had already retrieved customer information.

The company did not begin investigating possible unauthorized access to the archived records until October 12, more than three months after the security correction. On October 19, DigiCert confirmed that the account had accessed a portion of the database and determined that the incident required disclosure under certificate authority root program policies. Its investigation identified the unauthorized access window as June 27 through July 2 using file access records and application request activity.

According to DigiCert, most of the exposed information consisted of customer names, business email addresses, telephone numbers, and business addresses. A smaller portion of the affected accounts contained additional personal information, including customer-provided driver’s licenses, passports, utility bills, and other documents containing names and addresses. Such records present privacy and identity-related risks because they can associate an individual with a particular business and provide identifying information beyond ordinary corporate contact details.

The company characterized the affected records as a small proportion of its archived customer data but did not disclose the number of affected individuals, customer organizations, or documents accessed. The publicly available incident report does not identify the person responsible for the unauthorized account or establish whether the accessed information was misused or transferred to additional parties.

DigiCert emphasized that the intrusion did not compromise its certificate authority operations, including CertCentral and DigiCert ONE. The unauthorized account could read archived business records but could not modify information, approve identity validations, request certificate issuance, or issue digital certificates. A review of certificate authority and validation logs found no associated certificate issuance, modification, or revocation activity. The company reported that customer login credentials and existing digital certificates remained secure, valid, and trusted.

DigiCert reported that its certificate authority infrastructure operated on separate secured network segments, preventing the unauthorized account from reaching certificate issuance operations.

DigiCert’s root cause analysis identified three contributing failures: the infrastructure migration changed the system’s network accessibility without an appropriate security review, monitoring and alerting were insufficient to identify unexpected account activity, and the application’s authorization model did not properly account for self-registered users. The company acknowledged that the migration had been handled as an infrastructure change rather than a security change requiring additional examination and approval.

The monitoring failure was particularly significant because the system had originally been designed for internal access through a VPN and multifactor authentication. When the network configuration changed, existing security assumptions were not reassessed. The application lacked adequate alerts for unauthorized account creation and unusual requests against internal endpoints. Investigators also determined that the initial assessment of the unauthorized accounts incorrectly assumed that users without assigned applications were unable to access stored data.

Following the investigation, DigiCert implemented additional security controls, including restrictions on external network access, stronger authorization checks, application-level monitoring, and revised internal approval requirements for infrastructure changes. The company disabled the unnecessary self-registration feature, moved remaining business system endpoints behind private network infrastructure, conducted penetration testing, and completed a review of application permissions. It also reset passwords for business system users and established clearer responsibility for monitoring the application’s security configuration.

The incident was disclosed through Mozilla’s Bugzilla platform under certificate authority compliance report 2084460. DigiCert identified reporting obligations associated with the Mozilla Root Store Policy, Google Chrome Root Program Policy, Microsoft Trusted Root Program Policy, and Apple Root Certificate Program. These programs establish security and operational requirements for certificate authorities whose digital certificates are recognized by major browsers and operating systems.

DigiCert corrected the unauthorized access pathway in July, but confirmation of the customer data exposure did not occur until October. The delay left a period during which the company had addressed the apparent technical weakness without fully establishing the consequences of the earlier unauthorized activity.

For an organization responsible for supporting digital trust across websites and enterprise systems, the breach raises serious questions about the protection of supporting customer records, even where certificate issuance infrastructure remains secure. The confirmed exposure involved archived business and personal information rather than compromised certificates, and the publicly disclosed evidence does not establish misuse of the records. DigiCert’s documented security failures and delayed recognition of the data access underscore the importance of treating network configuration changes as security-sensitive operations and ensuring that unexpected account activity receives a complete investigation.

DigiCert, Unauthorized Access to Business System — Full Incident Report, Mozilla Bugzilla, CA Certificate Compliance, Bug 2084460, November 2026, 11-page PDF reproduction. Includes incident chronology, affected data, root cause analysis, certificate authority impact assessment, and corrective action records. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE