What happened. DigiCert, one of the largest public certificate authorities, is notifying customers of a data breach. According to its incident report on Mozilla's Bugzilla, a February 2025 server migration put an internal business system that used to sit behind a VPN onto the open internet. That system let outsiders sign up for their own accounts, and an authorization flaw let those accounts read archived customer records.
The timeline. DigiCert spotted unknown accounts on the system in June 2026 but at first decided they could not see customer data. A report through its security research program then flagged that anyone could create accounts, and DigiCert patched access. Only on Oct 19 did it confirm that one outside account had read customer information between June 27 and July 2, 2026. DigiCert says it first treated it as an account-creation problem, not a data-access event.
What was taken. Names, business emails, phone numbers and business addresses for a small portion of archived customers, plus, where customers had submitted them for validation, driver's licenses, passports or utility bills. DigiCert has not said how many people are affected and is still reviewing the ID documents. It says the access was read-only: no certificates were issued, no validations approved, and customer logins and issued certificates are safe.
Why this matters to an enterprise. Certificate validation means handing a CA real identity papers, and this shows those files can sit in old internal systems for years. Two plain lessons: check what a migration actually exposes to the internet, and treat any unknown account on an internal system as a possible data access until logs prove otherwise. Expect targeted phishing that uses this data to pose as DigiCert renewals.