---
title: DigiCert: a 2025 migration left an internal business system reachable from the internet; an outside account read archived customer contact data and some ID documents | ctxsec
url: https://ctxsec.com/items/digicert-business-system-exposed-unauthorized-access-id-documents
description: "DigiCert says a Feb 4, 2025 migration moved an internal business system out of a VPN-only segment, making it reachable from the internet with an account self-registration feature that was never meant for it. Those accounts skipped MFA and, through an authorization flaw, could read archived customer data. DigiCert spotted outside accounts in June 2026 and fixed the access on July 2 but initially handled it as an account-creation issue; on Oct 19 it confirmed an unauthorized account had read data between about June 27 and July 2. Most records were names, business emails, phone numbers and addresses; a small minority included ID documents such as driver's licenses, passports or utility bills. DigiCert says certificate issuance, CertCentral, DigiCert ONE, customer login credentials and issued certificates were not affected."
status: "official (DigiCert full incident report on Mozilla Bugzilla 2084460, Nov 1; customer notifications going out Nov 5)"
published: 2026-11-05
---

> DigiCert says a Feb 4, 2025 migration moved an internal business system out of a VPN-only segment, making it reachable from the internet with an account self-registration feature that was never meant for it. Those accounts skipped MFA and, through an authorization flaw, could read archived customer data. DigiCert spotted outside accounts in June 2026 and fixed the access on July 2 but initially handled it as an account-creation issue; on Oct 19 it confirmed an unauthorized account had read data between about June 27 and July 2. Most records were names, business emails, phone numbers and addresses; a small minority included ID documents such as driver's licenses, passports or utility bills. DigiCert says certificate issuance, CertCentral, DigiCert ONE, customer login credentials and issued certificates were not affected.

[← Cybersecurity News](/news) · [markdown](/items/digicert-business-system-exposed-unauthorized-access-id-documents.md)

official (DigiCert full incident report on Mozilla Bugzilla 2084460, Nov 1; customer notifications going out Nov 5)

2026-11-05

### DigiCert: a 2025 migration left an internal business system reachable from the internet; an outside account read archived customer contact data and some ID documents

If you have dealt with DigiCert validation, expect convincing phishing that references your real order or validation details, and treat unexpected 'revalidation' or document requests with suspicion. DigiCert says it is still reviewing ID documents and will notify those people separately.

The wider lesson is the migration: re-check network exposure after moving systems between segments or zones, and turn off features (like self-registration) that a system inherits but doesn't need.

Sources: [Mozilla Bugzilla 2084460: DigiCert: Unauthorized access to business system (full incident report)](https://bugzilla.mozilla.org/show_bug.cgi?id=2084460) · [BleepingComputer: DigiCert data breach exposes customer information, identity documents (Nov 5)](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/)