First, the thing everyone wants to know: DigiCert says its certificate authority systems were not affected, and the attacker could not issue certificates. Good. Now the less comfortable part.
What Happened
DigiCert disclosed the incident on Mozilla's Bugzilla, as reported by SecurityWeek:
- An internal business system used to archive customer information was moved to a different network segment in February 2025 and was inadvertently exposed to the internet.
- The system's account manager had a self-registration feature, built for other purposes, that did not require MFA. Attackers used it to create a read-only account.
- That account accessed archived business customer contact data between June 27 and July 2, 2026. DigiCert blocked it on July 2.
- On October 12 DigiCert began suspecting the account had reached archived data, and its investigation confirmed it.
DigiCert says the access "could not write records, act as a validation approver, or issue certificates," and that the CA systems run on their own network segments. It hasn't said how many customers were affected.
What Was Exposed
Names, email addresses, phone numbers and business addresses. In some cases, driver's licenses, passports, utility bills and other documents customers had submitted for validation.
That second list is what makes this more than a contact-list leak. Identity documents are useful for impersonation long after a password would have been rotated.
Credit, and the Lesson
DigiCert published specifics in a public forum, and its remediation list is the right one: added monitoring and alerting, removed non-DigiCert accounts, reset passwords, turned off self-registration and verified who owns the system.
The lesson isn't really about DigiCert. It's two things almost every organization has: a system that moved and quietly became reachable from the internet, and a feature nobody remembered was on. (Same root cause as the WorkOS breach this week, honestly.) I work at Zscaler, so I'm biased toward "internal apps shouldn't be reachable from the internet at all," but you don't need any particular product to check what you're exposing.
What To Do
- If you're a DigiCert customer: expect targeted phishing that knows your name, title and that you buy certificates. Be extra skeptical of "certificate renewal" or "validation" emails and calls. Verify through your account directly.
- If you submitted identity documents: watch for notice from DigiCert, and treat those documents as potentially exposed.
- Audit your own self-registration features. Every app that lets someone create their own account needs MFA and a reason to exist.
- Re-check exposure after every network change. Moving a system between segments is exactly when "internal" turns into "internet."
Bottom Line
No bad certificates, which is the headline that matters most for the internet. But a forgotten archive with a self-service signup button and no MFA leaked ID documents for six days, and nobody noticed for three months. Go find your version of that system.
Sources: SecurityWeek and DigiCert's Bugzilla disclosure