DigiCert breach exposes customer contact data

An internal business system at DigiCert, a major certificate authority, was inadvertently left exposed to the internet, and attackers used a self-registration feature to create an account that reached archived customer information. The intrusion, which DigiCert disclosed in a breach notification, affected business customers' contact details and, in some cases, identity documents such as driver's licenses and passports.

Exposure began with a network move

The system at the center of the incident was used for archiving customer information. According to DigiCert, it was moved to a different network segment in February 2025, and that migration inadvertently made it reachable from the internet.

Once exposed, the system offered an account manager with a self-registration feature. That feature had been built for other purposes and did not require multi-factor authentication, according to DigiCert. Attackers abused it to create a read-only account that could view archived data.

The unauthorized account was active between June 27 and July 2, when DigiCert blocked it. The company initially investigated and remediated the matter as an account-creation event.

October discovery widened the scope

On October 12, DigiCert began to suspect that the unauthorized account might have accessed archived data. That suspicion prompted a new investigation, which concluded in October that the account had indeed been used to reach archived customer contact information.

The compromised data included names, email addresses, phone numbers, and business addresses. In some cases, the archived records also contained driver's licenses, passports, utility bills, and other documents that included a name and address supplied by customers.

DigiCert did not say how many customers might have been affected. SecurityWeek reported that it had emailed the company for information on the matter and would update the article if it responded.

Certificate systems stayed separate

DigiCert moved to limit concern about its core certificate authority operations, stating that the compromised account had no ability to alter records or issue certificates.

“The access could not write records, act as a validation approver, or issue certificates,” DigiCert says. “The CA systems operate on their own secure network segments and were not affected by this external access.”

— DigiCert

The company's statement places the affected archive system outside the network segments that host its certificate authority systems. Those systems, according to DigiCert, operate on their own secure network segments.

Remediation steps since mid-October

Since mid-October, DigiCert has implemented a series of changes aimed at closing the exposure and preventing a repeat. The company said it added additional monitoring and alerting, verified or removed remaining non-DigiCert accounts, and reset passwords for all business system users.

It also deactivated the self-registration feature that attackers had abused, and verified the ownership of the business system along with the enforcement of permission policies.

Those steps address the specific mechanism described in the breach notification: an account-creation path that did not require MFA and that allowed a new account to reach archived data. The company's account of the incident indicates the initial response focused on the account creation itself, with the data-access question surfacing later.

The data at stake for business customers

The archived information described by DigiCert falls into two broad categories. The first is routine business contact data: names, email addresses, phone numbers, and business addresses. The second is identity documentation that customers provided, including driver's licenses, passports, and utility bills containing a name and address.

Those document types are commonly used to verify identity and business standing. Their presence in an archived system, even one with read-only access, means the exposure extends beyond contact details for some customers.

DigiCert's notification did not specify how many customers fell into the latter category, nor did it provide a total count of affected business customers.

Timeline of a slow-burning discovery

The sequence described by DigiCert spans several months. The archive system moved to a new network segment in February 2025. The unauthorized account was created and used between June 27 and July 2, and blocked on July 2.

More than three months passed before the company began to suspect, on October 12, that the account had reached archived data. The investigation that followed confirmed the access and led to the remediation steps the company described.

• February 2025: internal archive system moved to a different network segment, becoming exposed to the internet
• June 27 – July 2: unauthorized read-only account created via self-registration and used to access archived data
• July 2: DigiCert blocks the unauthorized account
• October 12: company begins to suspect the account accessed archived data, launches investigation
• October: investigation determines archived customer contact information was accessed

What DigiCert has not said

The breach notification leaves several questions unanswered. DigiCert did not disclose the number of affected customers, nor did it identify the attackers or describe any demand or follow-on activity.

It also did not say whether the exposed archive system has been returned to service, or what specific monitoring and alerting changes were made beyond the general description provided.

SecurityWeek's report notes that the company was contacted for additional information. As of the article's publication, no customer count had been provided.

Why this matters for certificate customers

For organizations that rely on DigiCert for certificates, the incident is a reminder that the security posture of a certificate authority extends beyond its signing infrastructure. The systems that hold customer records, support documents, and account data can sit on separate networks but still contain material that attackers find useful.

The presence of passport and driver's license scans in an archive raises the stakes for affected business customers, who may need to consider whether those documents could support identity fraud or business email compromise attempts. DigiCert's notification did not describe any such follow-on activity.

The gap between the July 2 account block and the October 12 suspicion also suggests that detecting unauthorized access is not the same as understanding what that access reached. For customers, the practical question is whether their own records were among those archived and accessed, and DigiCert has not yet provided a count that would help them assess that risk.