DigiCert, a prominent certificate authority, has disclosed a data breach involving an internal business system that was inadvertently exposed to the public internet. The incident, which the company detailed in a post-mortem report submitted to Mozilla’s Bugzilla platform, stemmed from a configuration error during a network migration. While the company has confirmed the unauthorized access, it maintains that its core certificate issuance infrastructure remained secure and was not compromised by the intruders.
The vulnerability originated in February 2025 when an internal system was transitioned out of a VPN-restricted environment. This change effectively removed the network-level access controls that had previously protected the system. DigiCert acknowledged that the migration was categorized internally as a standard infrastructure update rather than a security-sensitive change, which allowed the system to bypass the rigorous review and sign-off procedures typically required for security-critical assets.
DigiCert identified the exposure on June 21, 2026, noting that an unauthorized account had been created within the system. Following an internal investigation, the company confirmed that the system was accessed by external actors beginning on June 27, 2026. The vulnerability was remediated by July 2, 2026. By October 19, the firm formally confirmed that the incident constituted a reportable event under the security requirements set forth by major browser vendors and operating system providers, including Mozilla, Google, Microsoft, and Apple.
The compromised database contained a variety of sensitive information belonging to business customers. Confirmed data points accessed during the breach include customer names, business email addresses, and telephone numbers. Furthermore, the attackers gained access to identity documentation, such as driver’s licenses, passports, and utility bills, which are often submitted to certificate authorities for identity verification purposes. DigiCert has not disclosed the total number of customers impacted by the incident.
Despite the sensitivity of the exposed documents, DigiCert stated that it has found no evidence that the stolen information has been misused. The company emphasized that the breach was limited to the specific business system and did not grant the attackers the ability to issue, revoke, or otherwise manipulate digital certificates. Additionally, the company confirmed that customer login credentials for its primary services were not compromised during the unauthorized access.
The company attributed the delayed detection of the breach to a lack of sufficient alerting mechanisms. Specifically, the affected system failed to notify security teams when a new account was created through the externally accessible endpoint, nor did it provide adequate monitoring for anomalous request volumes. These technical gaps allowed the unauthorized activity to persist for several days before it was identified by internal staff.
In the wake of the incident, DigiCert has initiated communication with affected customers, many of whom have shared their notification emails on social media platforms. These users have expressed significant concern regarding the potential for identity theft, particularly given the nature of the documents exposed. The company has confirmed that it is cooperating with law enforcement agencies regarding the investigation.
DigiCert has declined to comment on whether the threat actors have attempted to contact the company or issue any demands. For now, the organization states that its primary focus remains on providing relevant information to its customer base. The incident serves as a notable case study in the risks associated with infrastructure migrations, highlighting the necessity of treating network changes with the same level of security scrutiny as software updates or patch management.
