DigiCert, a major digital certificate provider, has confirmed a security incident involving archived customer information. Some of the exposed records include sensitive identity documents. The company shared the details on Mozilla’s public Bugzilla platform.
It explained that an internal business system became reachable online after an infrastructure move in February 2025. The gap stayed open from that month until July 2026. The incident has also triggered criticism of X.
Internal system stayed open for 17 months
According to the incident report, the problem began on February 4, 2025. DigiCert moved the internal system from a VPN-restricted network to another availability zone. That move accidentally opened the system to outside access. It also switched on an account registration feature. The system was never meant to accept public sign-ups.
Accounts made through that feature did not need multi-factor authentication (MFA). DigiCert normally requires an MFA for its own staff. These accounts had read-only permissions and no application assigned to them. Even so, they could still open archived customer records.
Roughly 16 months passed before DigiCert spotted accounts that did not belong to its employees. That happened on June 18, 2026. An early review wrongly decided that accounts without an assigned application could not reach stored data. The company got another report through its managed security research program on June 21. It deployed an authorization fix on July 2.
The exposure ended in July 2026. Investigators later found that an unauthorized account had opened archived records between June 27 and July 2, 2026. DigiCert did not confirm that customer data had actually been accessed until October 19, 2026. That came about four months after the company first noticed the odd accounts.
Customers had submitted these records to verify their identities. That makes the incident especially concerning. Most of the viewed records held business contact details. However, a small number of customer accounts also held passports, driver’s licences and utility bills. Other documents showing names and addresses were stored there too.
DigiCert says the unauthorized account could not change any records. It could not approve identity checks or issue certificates either. The company also states that its certificate authority services stayed safe. CertCentral and DigiCert ONE were not affected. Customer login details and issued certificates stayed untouched too.
X Users React to the Lapse
The disclosure drew comments from cybersecurity watchers and other users on X. Many asked how a company responsible for digital trust could overlook such a weakness. Several posts focused on the long exposure and the missing MFA. International Cyber Digest pointed to the 17-month exposure. The account also noted that an outside account could read customer identity records without MFA.
A user named Cozy (@Cozy2054934) questioned why open registration was allowed on a system holding passports. Cozy argued that platforms storing identity papers should demand MFA. The user also said these platforms should send alerts when a newly created account starts viewing records.
Secure.com (@Securedotcom) called the case ironic. The account said a firm that checks everyone’s identity let strangers join without any check. The comment played on the gap between the company’s job and its own lapse.
Stephanie W. Michaelson (@DiamondRioOhMe) offered a different view on building products. She compared getting security right from the start with launching fast and improving later. Another user, AnKo (@anko_979), replied with sarcasm. AnKo joked that a much bigger group of violinists would be needed to play sad music for this. The reply mocked the company’s situation.
DigiCert Locks Down Systems and Lists Final Tasks
After the investigation, DigiCert switched off self-registration on every business system instance. It moved the remaining outside-facing endpoints behind private network infrastructure. The company also reset passwords and reviewed system permissions. It added more monitoring too. Any change to network access controls now needs security approval.
The company published these steps in its incident report on Bugzilla. The report also lists two open tasks due on November 6, 2026. The first is an internal audit. It will confirm that no business system origin servers remain open to the outside. The second is a final review of automated alerts. These alerts cover unexpected account creation and permission changes.
DigiCert has not shared how many customers, people or documents were affected. It says the incident touched only a small share of its archived information. The company maintains that its certificate systems remain secure. However, this is not the company’s only reported security incident, as a previous DigiCert breach led to the theft of code-signing certificates used in a malware campaign.s The report’s dates run from February 2025 to November 2026. They cover the move, the odd accounts, the fix and the confirmation.
The case raises questions about how firms guard identity documents that customers hand over. DigiCert helps build trust across the internet. This failure shows why internal systems need strong access controls and steady monitoring. They also need a security review after every infrastructure change.
