DigiCert Confirms Unauthorized Access to Archived Customer Records
Summary
DigiCert confirmed unauthorized access to archived customer records after an exposed self-registration path bypassed MFA. Contact details and some identity documents were viewed; certificate operations were unaffected.
Key points
- DigiCert confirmed an unauthorized account accessed archived customer data between June 27 and July 2, 2026; the number of affected accounts was not disclosed.
- Exposed records included customer names, business email addresses, phone numbers and office addresses; some accounts also contained identity documents.
- A network migration exposed an internal account-management platform, and its self-registration feature allowed accounts to bypass MFA.
- The account had read-only permissions; DigiCert said no certificates were issued, modified or revoked, and PKI operations were unaffected.
- DigiCert patched authorization on July 2, restricted access, deactivated self-registration and moved remaining endpoints behind private-IP load balancers.
- The company added SIEM alerts for file access and request volumes and now requires formal security sign-off for network accessibility changes.
Article Details
- Victim Organization
- DigiCert
- Incident Type
- Unauthorized read-only access to archived customer records following exposure of an internal account-management platform to the public internet.
- Incident Date
- 2026-06-27
- Disclosure Date
- 2026-10-19
- Data Types Exposed
- Customer names
- Business email addresses
- Telephone numbers
- Physical office addresses
- Customer-provided identity verification documents, including driver’s licenses, passports, utility bills, or other documents with names and addresses
- Affected Records
- Exact number of affected customer accounts not disclosed.
- Operational Impact
- An unauthorized account viewed archived customer files between June 27 and July 2, 2026. The account had read-only permissions. No certificates were issued, modified, or revoked, and certificate authority servers were not affected.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed