A 2025 Network Move Left a DigiCert Archive Reachable From the Internet. Customer Contact Details and Some ID Documents Were Read
Certificate authority DigiCert says an outsider created an account on an internal archive system and read customer contact details, and in a small number of cases ID documents such as passports and driver’s licenses. Certificates were not affected. Here is what was and was not exposed, and the chain of small mistakes behind it.
DigiCert, one of the best-known issuers of the security certificates that put the padlock on websites, has confirmed that someone outside the company read archived customer information over several days this summer. The company stresses that its certificate systems were never touched. The more useful story for most businesses is how the door was opened in the first place.
The details come from DigiCert’s full incident report, filed publicly on Mozilla’s bug tracker, as summarized by CyberSecurityNews.
What was exposed
- Business contact details of customer representatives: names, business email addresses, phone numbers and business addresses.
- For a small minority of accounts, a document the customer had supplied to prove identity, such as a driver’s license, passport or utility bill.
- DigiCert describes the affected data as a small proportion of the archive and has not published a count of affected people, organizations or documents.
What was not affected, according to DigiCert
- Its certificate authority services, CertCentral and DigiCert ONE.
- Customer login credentials.
- Issued certificates. No certificates were issued, changed or revoked, and customers do not need to replace active certificates.
- The account could only read; it could not change records, approve validations or request certificates.
The chain of small mistakes
- February 4, 2025: During an infrastructure migration, the archive system was moved off a VPN-only network segment into a zone that could be reached from outside.
- A leftover feature: The account manager behind the system included a self-registration feature meant for other uses. It became available on this system, and accounts created through it skipped the multi-factor login DigiCert otherwise requires.
- A permissions gap: Those new accounts had no application assigned and were read-only, but they could still see archived data.
- June 18, 2026: Staff noticed accounts that did not belong to DigiCert. A reviewer concluded they had no data access, and the system was placed behind a web application firewall that blocked new sign-ups from outside.
- June 21–24: A report from DigiCert’s managed security research program flagged the sign-up problem, and the company verified it.
- June 27 to July 2: The window in which data was actually read, as the later investigation established. A fix that blocked unassigned accounts from the archive went live on July 2.
- October 12–19: DigiCert first suspected that archived data had been read, then confirmed it and treated the event as reportable.
Since then, DigiCert says it has turned off self-registration, moved the remaining exposed endpoints behind private networking, reset passwords on the business system, added monitoring, reviewed permissions and now requires security approval for network access changes.
What this means for your company
If you buy certificates from DigiCert and were asked for identity documents during validation, watch for a notice from the company and be extra wary of emails that mention your certificates or your ID; exposed contact details are exactly what targeted phishing needs. The broader lesson applies to any business: a routine cloud or network migration can quietly change who can reach a system. After any move, re-check what is exposed to the internet, switch off features you do not use, make sure every login path requires multi-factor authentication, and keep logs long enough to answer “was anything read?” months later. Also ask how long you really need to keep copies of customers’ ID documents.
Planning a migration, or not sure what your last one left reachable from the internet? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
