An outsider read US firm DigiCert's customer archive, including copies of passports

An outside account read part of DigiCert's archive of customer records between 27 June and 2 July, the certificate authority says in an incident report on Mozilla's Bugzilla tracker. Most of what it reached was business contact data: names, work emails, phone numbers and business addresses. A "small minority" of customer accounts also held a document such as a passport, driver's licence or utility bill. DigiCert has not said how many people are affected.

How the system became reachable from outside

On 4 February 2025 DigiCert moved the system from a VPN-restricted network segment to another availability zone, which made it reachable from outside. The system also carried a self-service sign-up feature built for other products. Accounts created that way were not subject to multi-factor authentication and got read-only rights by default, and that was enough to open archived data.

The report says nobody caught this because the move "was treated as an infrastructure change rather than a security change". Alerts for new accounts and unusual request volumes were also too weak.

Seen in June, understood in October

DigiCert writes that the case "was initially handled as an account-creation issue rather than a data-access event". The first review went wrong because the account had no application assigned, so staff assumed it could read nothing.

What the company says was not touched

According to the report, the account could not write records, approve validations or issue certificates, and logs show no issuance or revocation linked to it. Certificate authority systems sit on separate network segments. DigiCert says customers do not need to replace active certificates. This is also a different case from April's support portal hack, after which it revoked 60 code signing certificates.

What is still unknown

The report gives no count, and offers summary statistics only to root programme representatives on request. A commenter on the Bugzilla thread has asked for numbers and for confirmation that this was subscriber verification data, and another asked what raised suspicion on 12 October. DigiCert's replies so far only mark action items as complete.

The company is still reviewing identification documents to work out who was affected. A spokesperson told The Record there is "no evidence of misuse", said law enforcement has been informed, and declined to say whether the attackers had made contact. Who was behind the account has not been disclosed.

If you got the email

Our reading: the likeliest follow-up is phishing. Whoever holds this data knows your name, your work email and that you are a contact on a DigiCert customer account, so a fake renewal or revalidation notice would look plausible. Since DigiCert says no action is needed on certificates, treat any message about this incident that asks you to log in or reissue with suspicion. If you ever sent DigiCert an ID, ask whether it was in the accessed set. A copy of an ID stays useful to fraudsters for years, which is why Japan's regulator told banks to stop accepting uploaded photos after a similar leak.