DigiCert, one of the world’s largest certificate authorities, has admitted that an outsider spent several days reading archived customer validation records, including some passport and driving licence scans. The cause was not a sophisticated exploit but an internal system quietly left open to the internet during a network move some sixteen months earlier.
What happened
DigiCert has published a full incident report on Mozilla’s Bugzilla tracker, the public venue where certificate authorities answer to browser root programmes, confirming unauthorised access to an internal business system. That system archives the information that customer representatives hand over when DigiCert checks who they are before issuing organisation-validated or extended validation certificates.
According to the report, the intruder had read access to archived data between 27 June and 2 July 2026. Most of the records reached were business contact details: names, work email addresses, phone numbers and office addresses. For what DigiCert calls a small minority of customer accounts, the archive also held identity evidence such as a passport, a driving licence or a utility bill.
DigiCert says it confirmed on 19 October that archived data had actually been accessed, treated it as a reportable event and filed a preliminary report the following day. The full report followed in early November. DigiCert has not said how many people or organisations are affected; customer emails say it is reviewing the identity documents so it can notify the individuals concerned. DigiCert stresses that its certificate authority platforms, CertCentral and DigiCert ONE were not touched, that no certificates were issued, altered or revoked, and that customers do not need to replace live certificates.
The technical picture
On 4 February 2025, as part of an infrastructure migration, the archive system was moved out of a network segment reachable only over VPN and into an availability zone that could be reached from the internet. Nobody carried out a security review of what that change exposed.
The system sat on an account management platform that DigiCert also uses elsewhere, and that platform ships with an optional self-service sign-up flow. DigiCert staff log in to the archive with multi-factor authentication, but accounts created through the sign-up page bypassed MFA entirely and were given read-only status by default. The flaw that turned a nuisance into a breach was in authorisation: those unassigned, self-registered accounts could still open archived records.
The timeline shows how close DigiCert came to catching it. Staff spotted non-employee accounts on 18 June 2026 but assumed that, lacking an application assignment, they were harmless; the system was put behind a web application firewall that blocked new sign-ups. A report through DigiCert’s managed security research programme on 21 June then flagged the open registration route. Even so, the investigation later established that data was read from 27 June until an authorisation patch went live on 2 July, after which unassigned accounts received a 401 response. DigiCert initially handled it as an account creation bug rather than a data access event, hence the October confirmation.
DigiCert lists three contributing factors in its root cause analysis: network accessibility changed without a security review, monitoring of account activity on the system was inadequate, and the permissions model never anticipated self-registered users. Fixes include disabling self-registration everywhere, moving remaining endpoints onto private load balancers, resetting passwords for all users of the system, an external penetration test, file access alerting and mandatory security sign-off for network changes to internal tools. Two final items, an audit confirming no origin server is externally reachable and a review of account creation alerting, were due on 6 November; DigiCert has since reported the alerting review as complete.
Why it matters for UK organisations
DigiCert’s TLS and code-signing certificates are widely used by UK businesses, public bodies and software houses. Anyone who has bought an OV or EV certificate will know the routine: a named representative proves their identity and their employer’s existence, sometimes uploading personal documents. They may not remember what they sent.
For UK organisations this is a personal data incident involving their employees, even though they were not the party breached. Under UK GDPR, DigiCert as controller of that archive would carry the main notification duties, but customers should be ready for questions from staff and should consider whether their own records of processing reflect what was shared with the supplier. Scans of passports and driving licences are particularly useful for identity fraud and for convincing social engineering, so affected individuals deserve proper support rather than a generic email.
There is also a phishing angle. Attackers holding real names, roles and contact details for the people who manage certificates can craft very believable messages about expiring certificates, failed validations or urgent revocations. Those are exactly the people with access to domain registrars, DNS and signing infrastructure.
Expert view
When we test cloud estates, the most damaging findings are rarely clever exploits. They are internal admin and back-office tools that someone moved, re-platformed or re-hosted and assumed were still private. This incident is a textbook case of relying on network location as a security control. The moment the VPN boundary disappeared, nothing in the application stopped a stranger signing up and reading files.
The second lesson is about inherited features. Off-the-shelf identity and account platforms carry functions intended for other use cases, and self-registration is the classic example. In my experience these are almost never switched off deliberately; they are simply not noticed. Every internal system should be reviewed for who can create an account, not just who can log in.
DigiCert’s write-up is detailed and candid, and the root programme process forced a level of transparency that many breached companies avoid. The gap is the missing numbers. A commenter on the Bugzilla thread has already asked DigiCert publicly for figures.
What to do now
- Identify your exposure. List the people in your organisation who have acted as DigiCert validation contacts and ask DigiCert directly whether any of their documents were accessed.
- Support affected staff. Advise anyone who uploaded a passport, licence or utility bill to watch for fraud, consider a credit file check and treat unsolicited contact with suspicion.
- Brief certificate administrators on phishing. Expect DigiCert-themed lures. Verify any validation or revocation request by logging in to your account, never through a link in a message.
- Do not revoke certificates in a panic. DigiCert says live certificates are unaffected; unplanned revocation causes outages.
- Review CertCentral access. Check users, API keys and recent sign-in activity, and enforce MFA (Cyber Essentials: user access control and secure configuration).
- Audit your own migrations. For any internal tool moved in the past two years, confirm it is not internet-facing, that self-registration is disabled and that authorisation is enforced in the application, not just at the network edge (Cyber Essentials: firewalls and secure configuration).
Bottom line
No certificates were compromised, and the trust chain that underpins UK web traffic is intact. But an archive of identity documents sat behind a forgotten sign-up page for well over a year, and organisations whose staff used DigiCert’s validation process should assume they may be affected until told otherwise. The wider warning is for every security team: a network move is a security change, and should be reviewed as one.
Sources
- Mozilla Bugzilla: DigiCert: Unauthorized access to business system (bug 2084460)
- GBHackers: DigiCert Confirms Data Breach After Security Misconfiguration Exposes Customer Personal Information
- Cyber Security News: DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents
- 2-Spyware: DigiCert breach exposed customer IDs and contact data
- Brandefense: DigiCert Breach: What Customers Check First
