DigiCert, the certificate authority, disclosed in late October 2026, with full details on 1 November, that an internal business system had been reachable from the internet since a network move in February 2025. An outside account read archived customer contact data from 27 June to 2 July 2026. DigiCert says certificate issuance was unaffected. A lesson for any migration.
What happened
DigiCert set out the timeline in an incident report it filed with Mozilla's CA Program. BleepingComputer reported the breach on 5 November 2026 and SecurityWeek on 6 November.
| Date | Event, as DigiCert describes it |
|---|---|
| 4 February 2025 | The business system is moved from a VPN-restricted network segment to a different availability zone, which makes it reachable from outside |
| 18 June 2026 | DigiCert's team notices accounts that do not belong to DigiCert staff, blocks the registration endpoint at its web application firewall, and concludes they have no data access |
| 21 June 2026 | A report through DigiCert's managed security research program indicates that outsiders may be able to create accounts |
| 27 June to 2 July 2026 | An unauthorized account reads archived data (the access window DigiCert later established) |
| 2 July 2026 | DigiCert releases an authorization fix |
| 12 to 19 October 2026 | DigiCert suspects, then confirms, that archived data was accessed |
| 24 October 2026 | Self-registration is switched off |
How the account got in. A self-registration feature from DigiCert's account manager, which was never meant for this system, could be reached on it. Accounts created that way did not require multi-factor authentication and were read-only by default, but read-only was enough to view the archive.
What was exposed. DigiCert says only a small proportion of the archive was accessed. Most records held business contact details: names, business email addresses, phone numbers and business addresses. For a small minority of customer accounts, the archive also held a document the customer had supplied, such as a driving licence, passport or utility bill. DigiCert has not said how many customers were affected, and BleepingComputer reported on 5 November that DigiCert was still reviewing the documents to identify them.
What was not affected. DigiCert says the account could not write records, approve validations or issue certificates, and that its logs show no validation, issuance or revocation activity. BleepingComputer reports that DigiCert's certificate authority services, CertCentral and DigiCert ONE were not compromised. On 7 November, DigiCert told Mozilla that it has contacted the affected customers and reported the incident to law enforcement. None of the sources we read says whether the data has been misused.
What it means for businesses
These points are our reading of the published timeline, not statements by DigiCert.
A migration can change who can reach a system. The exposure began with a network change, not an attack on a software bug. A network move removed the VPN restriction around the system, and that went unnoticed for more than a year. A gap in how the system checked permissions then turned that exposure into data access. Cloud moves, data centre exits and network redesigns all carry this risk.
Unused features become entry points. The self-registration endpoint was intended for other uses. Once the system was exposed, a feature nobody needed on it became the way in.
Old archives keep their risk. The archive held identity documents that customers had supplied to DigiCert. An archive like this carries risk for as long as it is kept, and data you no longer need cannot leak if it is gone.
Read access is still a breach. A read-only account caused the exposure. Contact details of this kind are commonly used to make phishing emails look genuine.
What to do next
- Add an exposure check to every migration cutover. After any move between networks, zones or hosts, test from outside which systems and endpoints are reachable, and compare the result with the plan. Our cloud ERP migration risks and rollback plan covers where this fits in a cutover.
- List the endpoints each system exposes, and switch off features it does not use, such as self-registration, sample accounts and admin tools.
- Require multi-factor authentication on every way into a system, including accounts that users create themselves, and give new accounts no access until someone approves them.
- Alert on accounts created outside the normal process. DigiCert's team saw unfamiliar accounts on 18 June but concluded they could not reach data. Treat such accounts as possible data access until the logs show otherwise.
- Set retention rules for identity documents and archives. Delete or move them offline once their purpose is complete.
- Log reads as well as changes, and keep the logs long enough to work out months later what an account viewed.
- If you are a DigiCert customer, DigiCert says no action is needed for active certificates. Treat unexpected emails or calls that mention your account with care, and confirm them through a known contact.
Timeline Digital, a custom software development company founded in 2013 in Islamabad, builds and supports business software as managed projects, including cloud and DevOps infrastructure work and legacy system modernization. Every project starts with a free pilot: Before you commit to the full project, we build 2 to 3 of your key modules as working software, free of charge, ready in about 2 days. Your team tests the pilot, and the full build starts only after you approve it.
Sources
- DigiCert: Unauthorized access to business system, DigiCert incident report in Mozilla's CA Program bug tracker, preliminary report 20 October 2026, full report 1 November 2026, follow-up 7 November 2026
- DigiCert data breach exposes customer information, identity documents, BleepingComputer, 5 November 2026
- DigiCert Data Breach Impacts Business Customer Information, SecurityWeek, 6 November 2026