DigiCert is telling business customers that a misplaced internal system sat open to the public internet for over a year, and an outsider reached archived records including scanned passports and utility bills.
A server move that skipped the review
The certificate authority’s incident report, filed in Mozilla’s bug tracker, dates the problem to February 2025. An internal system was moved out of a VPN-protected network into another availability zone, and the move also exposed it to the internet. Nobody noticed for 16 months.
The archive shared an account-management platform with DigiCert’s customer-facing products, including self-registration that should never have been reachable. Outsiders could create accounts without multifactor authentication and, through a separate permissions flaw, browse stored customer records.
Months between warning and shutdown
DigiCert spotted the rogue accounts on June 18, 2026 and dismissed them because no application was attached. A researcher flagged the sign-up problem three days later, yet the feature stayed up until July 2. Only on October 12 did the company ask whether data had been read, then confirm an unauthorized account opened archived records between June 27 and July 2.
The company calls the affected records a small share of its archive and will not say how many people are involved. Notices list names, business contact details and addresses, with identity documents possible.
Why certificate authorities get extra scrutiny
A CA holds the trust root for encrypted traffic across the web, so a lapse in its own housekeeping invites questions from browser vendors and auditors as well as regulators. The postmortem lists familiar failures: no security review for the migration, monitoring that missed the activity, and access controls blind to self-registered accounts. Any customer who uploaded identity documents for verification should assume they were in scope.
Self-registration is now off, network access narrowed and monitoring added.
