DigiCert Data Breach Caused by Server Migration Misconfiguration Exposes Customer Identity Records

Certificate authority DigiCert confirmed on November 5 that it suffered a data breach impacting customer records. According to an incident report submitted to Mozilla Bugzilla and notifications sent to affected clients, the issue originated during a server migration in February 2025, which inadvertently exposed an internal business system—previously accessible only via VPN—to the public internet. The system contained a self-registration mechanism intended for other applications, allowing external users to create accounts. Due to an authorization control vulnerability, these unauthorized accounts were able to access archived customer data in read-only mode, even though they lacked assigned applications. Exposed records include names, business email addresses, phone numbers, corporate addresses, and identity verification documents submitted for certificate validation, such as passports, driver's licenses, and utility bills. DigiCert initially spotted the unauthorized accounts in June 2026 but later confirmed through security research reports and forensic investigations that unauthorized access took place between June 27 and July 2 before security patches were deployed.

Key takeaways

• DigiCert reported that a February 2025 server migration error accidentally exposed an internal, VPN-only system to the internet.
• External users exploited self-registration and authorization flaws to access archived customer records in read-only mode.
• Compromised data involves contact information and identity verification files, including passports, driver's licenses, and utility bills.
• Investigation revealed unauthorized access occurred from June 27 to July 2, 2026, leading to subsequent access restrictions and patches.