DigiCert, one of the largest issuers of TLS certificates, has confirmed that an outsider accessed customer data in an internal business system. Its incident report to browser root programs (Mozilla bug 2084460) says an account that should not have existed read archived customer records between 27 June and 2 July 2026. DigiCert confirmed on 19 October 2026 that the incident had to be reported, and the breach became public this week.
What went wrong: on 4 February 2025, a migration moved the system from a VPN-only network segment to one reachable from the internet. That exposed a self-registration page from the account-management platform, a feature meant for other uses. Anyone could create an account. New accounts needed no MFA and got default read-only rights that still reached archived customer data. DigiCert noticed outside accounts on 18 June 2026 but first concluded they could not see any data. A security research programme reported the open registration on 21 June. An authorisation fix went out on 2 July.
What was exposed: mostly business contact details, meaning names, business email addresses, phone numbers and business addresses, from what DigiCert calls a small proportion of archived data. A small minority of records also held documents customers had supplied, such as a driver's licence, passport or utility bill. DigiCert has not said how many customers are affected. A commenter on the Mozilla bug has asked it for numbers.
What was not affected, according to DigiCert: its certificate authority systems, CertCentral, DigiCert ONE, customer login credentials and issued certificates. The accounts could not write records, approve validations or issue certificates, and the logs show no such actions, so no certificates need to be revoked. DigiCert has since turned off self-registration, moved the remaining endpoints to private networks, reset business-system passwords and added file-access alerts. A final audit is due on 6 November.
