DigiCert breach: 513 days exposed, 109 more to confirm data access

DigiCert has started telling customers that an outsider read archived records with the contact details of their representatives: names, phone numbers, business addresses and work email addresses. For a small minority of accounts the records also held an identity document a representative had supplied, such as a driver's license, passport or utility bill. The certificate authority says no certificates were affected and customers need to do nothing about active certificates. It has not said how many people are involved.

The detail a buyer needs is in the full incident report DigiCert filed on Mozilla's CA compliance tracker, bug 2084460. Its dates show how long the gap stayed open and how long DigiCert took to see what had been read.

What DigiCert's own timeline shows

• February 4, 2025: an infrastructure migration moved an internal business system out of a VPN-only network segment into an availability zone that the internet could reach. A self-registration feature meant for other uses came along. Accounts made through it skipped the MFA DigiCert otherwise requires and were read-only, but could still read archived data.
• June 18, 2026: DigiCert staff saw accounts on the system that did not belong to DigiCert. Because none was assigned to an application, the reviewer decided they could not reach any data.
• June 21 and 24: DigiCert's managed security research program reported that outsiders could create accounts, and DigiCert confirmed it.
• June 27 to July 2: the window in which the data was read, as the later investigation established.
• July 2: an authorization fix closed that access.
• October 12: DigiCert first suspected archived data had been read. It confirmed this on October 19, judged it reportable under the browser root programs' rules, and filed a preliminary report on October 20.

By our count, the system sat exposed for 513 days, from the migration to the July 2 fix. Another 109 days passed between the end of the access window and DigiCert's confirmation, and 123 days between staff first noticing the outside accounts and that confirmation. DigiCert's report says the case was first handled as an account-creation problem, not a data-access event.

It names causes any buyer can test a vendor against. DigiCert classed the migration as an infrastructure job, so it skipped the review a security change gets. MFA applied only to accounts assigned to an application. Alerting on new accounts and on request volume was not good enough. DigiCert's own lesson is that authorization should not be handed to where a system sits on the network.

What is still unanswered

DigiCert has given no public count of people, organizations or documents; its report says it can share summary statistics with root program representatives on request. BleepingComputer and SecurityWeek both asked and had no answer when they published. The breach notice says DigiCert is still reviewing identity documents to work out who was affected, BleepingComputer reports. On the Mozilla bug, one commenter asked DigiCert to confirm whether subscriber verification data was exposed and to give numbers. Another asked what made DigiCert suspect a breach on October 12 and how the system connects to certificate validation.

Two other CA incidents reported in the same weeks

DigiCert's report lists two related cases on the same tracker. TWCA reported that its monitoring found signs of unauthorized access to its registration authority server, and that it has found no mis-issued certificates so far. D-Trust reported that E.ON, which runs a delegated registration authority for it, lost identity validation records for S/MIME certificates issued from 2015 to 2022. Its rules for that authority required keeping them for seven years after the certificates expired.

What IT teams should do

• Do not revoke or reissue DigiCert certificates because of this notice. DigiCert says its CA systems, CertCentral and DigiCert ONE were not reached, and that active certificates stay valid and trusted.
• List the people your company has named as DigiCert contacts, and anyone who uploaded an identity document during validation. Tell them their details could be in scope.
• Brief the help desk and mail team. Brandefense, a threat intelligence firm, expects messages using DigiCert branding and real names, for example asking for a passport to be uploaded again. It says this is its reading, not a reported campaign.
• Ask your CA, in writing, how many of your records and which documents were involved and when you will hear. Ask any vendor holding staff identity documents whether a network change gets a security review, whether MFA covers every way an account can be created, and how long validation documents are kept.
• Run the same test at home: list internal tools that changed network segment since early 2025 and confirm none answers from the internet, and switch off self-registration wherever it is not needed.

Sources: DigiCert incident report, Mozilla bug 2084460, BleepingComputer, SecurityWeek, SC Media, Cyber Daily, TWCA, Mozilla bug 2086949, D-Trust, Mozilla bug 2085547, Brandefense.