Threat watch / Breach
DigiCert: self-registered accounts read archived customer data
DigiCert says a business system left reachable from the internet let outsiders register accounts without MFA and read archived customer validation data, including some identity documents. Certificates were not affected.
- Sector
- Tech & SaaS
- Way in
- Exposed or misconfigured
- Product or vendor
- DigiCert
- How it happened
- A February 2025 move of the system "from a VPN-restricted network segment to a different availability zone" made it reachable from outside, with a registration feature "intended for other use cases" exposed. Accounts created this way had no MFA, were read-only by default, but "had access to archived data".[1][2] Checked 8 Nov 2026
- What was stolen
- Names, business email addresses, phone numbers and business addresses, and for some customers a document "such as a driver's license, passport, utility bill". DigiCert says the access could not write records or issue certificates, and that login credentials and certificates remain secure.[1] Checked 8 Nov 2026
- Who was impacted
- DigiCert customers whose validation records sat in the archive. No count is public; DigiCert says it has contacted the affected customers and will share summary statistics with root program representatives on request.[1] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- The system moves out of a VPN-restricted segment and becomes reachable from the internet. [1]
- A managed security research program reports possible external account creation. DigiCert first treats it as an account-creation issue. [1]
- Start of the window, until July 2, in which the archived data was accessed, according to DigiCert's later investigation. An authorization fix ships on July 2. [1]
- DigiCert determines a reportable event, after first suspecting access to archived data on October 12. A preliminary report follows on October 20. [1]
- Self-registration is turned off. DigiCert says it has reported the incident to law enforcement. [1]