DigiCert says self-registered accounts read archived customer data, including some identity documents

On 5 November 2026, DigiCert — the Lehi, Utah certificate authority that issues the TLS and code-signing certificates underpinning much of the public web's trust — detailed a data exposure in an incident report filed on Mozilla's Bugzilla. The root cause was a configuration mistake rather than an exploit: during a 4 February 2025 infrastructure migration, an internal business system was moved from a VPN-restricted network segment to an internet-reachable zone, which also switched on an account-registration feature never meant for public sign-ups. The newly created accounts lacked the multi-factor authentication DigiCert requires of staff, yet they could still open archived customer records — and the system sat exposed for roughly 17 months.

What was exposed

The archived records were material customers had previously submitted to verify their identities. Most of the data an unauthorized account viewed consisted of business contact details — names, business email addresses, phone numbers and company addresses. For a small minority of accounts, the records also included customer-provided identity documents such as passports, driver's licences and utility bills, along with other documents showing names and addresses. DigiCert has not disclosed how many customers, individuals or documents were affected, saying only that a small share of its archived information was touched.

DigiCert stressed what the intruder could not do: the unauthorized account could not modify records, approve identity checks or issue certificates. Its core certificate-authority services, the CertCentral and DigiCert ONE platforms, customer login credentials, and already-issued certificates were all unaffected.

How it unfolded

DigiCert first noticed accounts that did not belong to employees on 18 June 2026, and an early internal review mistakenly concluded those accounts could not reach stored data. A separate report arrived through the company's managed security-research program on 21 June. An unauthorized account read archived records between 27 June and 2 July 2026, and DigiCert deployed an authorization fix on 2 July that ended the exposure. It was only on 19 October 2026 that the company confirmed customer data had actually been accessed, with the public incident report and individual notifications following in early November.

Response

DigiCert disabled self-registration across all instances of the business system, moved remaining outside-facing endpoints behind private network infrastructure, reset passwords, reviewed system permissions and expanded monitoring. It said it now requires security approval for changes to network access controls. For a certificate authority — an institution whose entire value rests on trust — the episode is a pointed reminder that sensitive identity-verification archives demand the same perimeter discipline as the certificate-issuance systems themselves, and that a single misrouted migration can quietly undo it.