DigiCert data breach: misconfigured server exposed customer PII and identity documents
Severity: medium · Patch status: patched · Since 2026-10-21
DigiCert self-reported to Mozilla's CA Program (CCADB, bug 2084460) that a network change during a February 2025 server migration moved an internal business system out of a VPN-only segment and onto an externally reachable address. The system had a self-registration endpoint that let outside users create accounts not tied to any application, and an authorization gap gave those accounts read-only access to archived customer data. The access window was 27 June to 2 July 2026. DigiCert first saw the accounts in June and treated them as an account-creation issue; it first suspected unauthorized data access in October and confirmed it on 19 October. The affected archive is described as a subset of archived data. Business contact details (names, business emails, phone numbers, business addresses) were exposed, and for a small minority of accounts identity documents such as passports, driving licences and utility bills. DigiCert says its CA services, CertCentral and DigiCert ONE were not affected, no certificates were issued, modified or revoked, and the account could not approve validations or write records; log review reportedly found no validation or issuance activity linked to it. The number of affected customers is not disclosed. Remediation: the endpoint was blocked at the WAF, self-registration was disabled, an authorization patch returns HTTP 401 for accounts without an application, passwords were reset, alerting was added, and an internal audit was still open at the last update.
What to do
- Review DigiCert breach notifications and check whether your organization or staff are affected
- Assume exposed identity documents could be used for targeted phishing or identity fraud; warn affected employees
- Harden email filtering and train staff on phishing using real PII
- Monitor for fraudulent use of submitted identity documents and consider credit/identity monitoring where relevant
- Reassess what PII and verification documents you submit to CAs and retention practices
Sources
All live incidents on Threat Watch
