DigiCert: a 2025 migration left an internal business system reachable from the internet; an outside account read archived customer contact data and some ID documents
If you have dealt with DigiCert validation, expect convincing phishing that references your real order or validation details, and treat unexpected 'revalidation' or document requests with suspicion. DigiCert says it is still reviewing ID documents and will notify those people separately.
The wider lesson is the migration: re-check network exposure after moving systems between segments or zones, and turn off features (like self-registration) that a system inherits but doesn't need.
Sources: Mozilla Bugzilla 2084460: DigiCert: Unauthorized access to business system (full incident report) · BleepingComputer: DigiCert data breach exposes customer information, identity documents (Nov 5)